openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the agent to execute various subcommands of the
openspecCLI, such asopenspec list,openspec status, andopenspec instructions apply. These commands are used to select a change set, verify its status, and retrieve implementation details. This is the core functionality of the skill. - [PROMPT_INJECTION]: The skill operates on external data by reading project files (proposals, specs, design, tasks) and parsing JSON output from the CLI. This creates a surface for indirect prompt injection where instructions embedded in project artifacts could influence the agent's behavior.
- Ingestion points: Local project files listed in the
contextFilesoutput and JSON responses fromopenspecCLI commands. - Boundary markers: The instructions do not specify the use of delimiters or system-level warnings to distinguish between task data and potential embedded instructions.
- Capability inventory: The agent has the capability to execute shell commands (
openspec), read files, and modify code files to implement tasks. - Sanitization: No explicit sanitization or validation steps are mentioned for the content retrieved from external files before the agent acts upon it.
Audit Metadata