openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from context files and dynamic fields like context and operationGuidance provided by the openspec CLI. If a project repository or the tool output is compromised, it could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: SKILL.md instructs the agent to read all file paths listed in the contextFiles output from the instructions command and parse the context and operationGuidance fields from JSON output.
- Boundary markers: The instructions include conflict resolution logic, telling the agent to prioritize built-in workflow values and report conflicts with external guidance.
- Capability inventory: The skill allows for the execution of openspec commands and modification of files within the project workspace.
- Sanitization: The instructions do not specify any validation or sanitization steps for the external content before it is used to guide implementation.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute various openspec commands for store management, change selection, and instruction retrieval.
Audit Metadata