openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts on data retrieved from the
openspecCLI, including task lists, file paths, and implementation guidance. This represents an indirect prompt injection surface, though it is the intended primary function of the skill. - Ingestion points: The skill parses JSON outputs from
openspec statusandopenspec instructions apply, and reads files provided in thecontextFilesarray (SKILL.md, steps 2, 3, and 4). - Boundary markers: The instructions include strong defensive prompts, such as requiring the agent to prioritize CLI-controlled state over external guidance and explicitly forbidding the use of guidance as proof of task completion (SKILL.md, step 3, 'Guardrails').
- Capability inventory: The skill uses the
Bash(openspec:*)tool to interact with the project and modifies local files to implement requested changes (SKILL.md, step 6). - Sanitization: The agent is instructed to identify and report any conflicts between external guidance and the controlling workflow inputs rather than executing conflicting instructions blindly (SKILL.md, step 3).
Audit Metadata