openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing local shell commands through the
openspecCLI to manage workflows, retrieve project status, and fetch implementation instructions. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the local workspace to guide its code modification tasks, creating a surface for indirect prompt injection.
- Ingestion points: Reads file paths provided in the
contextFilesarray from theopenspec instructionsoutput (e.g., proposal, specs, design, and tasks files). - Boundary markers: No explicit delimiters or boundary markers are defined to isolate untrusted task content from the agent's core instructions.
- Capability inventory: The agent has the capability to perform arbitrary code edits in the workspace and update task status files based on what it reads.
- Sanitization: There is no evidence of content sanitization or validation performed on the task descriptions or specifications before they are used to generate code changes.
Audit Metadata