openspec-apply-change
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs and executes shell commands using input provided by the user, specifically the
<name>variable in commands likeopenspec status --change "<name>" --json. This presents a command injection risk if the user input contains shell metacharacters (e.g., quotes, semicolons, or pipes) that the agent's execution environment does not properly escape. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and acts upon content from external files (retrieved via
contextFiles) without any sanitization or boundary markers to distinguish between data and instructions. - Ingestion points: The agent reads all file paths listed in the
contextFilesoutput of theopenspec instructions applycommand (SKILL.md, Step 4). - Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to disregard instructions or prompts found within the processed files.
- Capability inventory: The agent has the capability to execute shell commands via the
openspecCLI and perform unrestricted file modifications in the local workspace. - Sanitization: Absent. The skill provides no mechanism to validate, escape, or filter the content of the tasks or files before the agent implements the described changes.
Audit Metadata