openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
openspecCLI using variables such as the change name, which can be provided by the user. If the agent does not properly escape these inputs when constructing the command strings, it could lead to command injection vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, including JSON output from theopenspecCLI and the contents of various project files (specs, tasks, design documents). These files represent an attack surface where malicious instructions could be embedded to influence the agent's code implementation or task management logic.\n - Ingestion points: CLI output from
openspec statusandopenspec instructions, and all files listed in thecontextFilesmetadata (e.g., proposal, specs, design, tasks).\n - Boundary markers: None identified; the instructions do not specify the use of delimiters or warnings to ignore instructions inside project data.\n
- Capability inventory: The skill performs shell command execution via the
openspecCLI and performs file writes/modifications to implement tasks and update task tracking files.\n - Sanitization: No explicit sanitization or validation of the content retrieved from the
contextFilesor CLI output is described.
Audit Metadata