openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files and CLI outputs that could contain embedded instructions.
- Ingestion points: Data is pulled from file paths identified in
contextFilesand from thecontextandoperationGuidancefields in CLI JSON output. - Boundary markers: The skill includes instructions to treat external data as advisory and to report conflicts with the primary workflow rather than blindly following it.
- Capability inventory: The skill utilizes the Bash tool to execute
openspeccommands and performs write operations to project files. - Sanitization: The instructions explicitly state not to copy runtime context or guidance into implementation artifacts, limiting the direct impact of injected content.
- [COMMAND_EXECUTION]: The skill relies on the Bash tool to execute various
openspecCLI commands, such asstatus,list, andinstructions, to drive the implementation workflow.
Audit Metadata