openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could be manipulated to influence the agent's behavior. (1) Ingestion points: The skill reads contextFiles (e.g., proposal, specs, design, tasks) and parses the context and operationGuidance fields from JSON output provided by the openspec CLI. (2) Boundary markers: The instructions include explicit warnings to treat context and operationGuidance as advisory, not to copy them into implementation files, and to prioritize CLI-controlled state over these inputs. (3) Capability inventory: The skill uses the openspec CLI to interact with the project and modifies local files to implement tasks and update status. (4) Sanitization: The skill instructs the agent to report conflicts between untrusted input and the controlling workflow, though no technical sanitization is performed on the text content itself.
Audit Metadata