openspec-bulk-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from local files to determine instructions for subagents.
- Ingestion points: Step 2 explicitly reads content from
contextFilesand tasks artifacts. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' warnings when passing context from these files to subagents.
- Capability inventory: The skill manages git worktrees and dispatches subagents that execute
/opsx-applyand/opsx-verifycommands. - Sanitization: There is no mention of sanitizing or validating the contents of the ingested files before they influence the subagents' work flows.
Audit Metadata