openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute various
openspecCLI commands (e.g.,openspec status,openspec instructions,openspec list). This is the core intended functionality for managing and implementing changes within the OpenSpec framework. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data by reading files listed in the
contextFilesoutput from the CLI. This surface could be exploited if an attacker provides a malicious specification or task file. - Ingestion points: Reads every file path listed under
contextFiles, including proposals, specs, design, and task files. - Boundary markers: The instructions do not define explicit boundaries or warnings for the agent to ignore instructions embedded within these external files.
- Capability inventory: The skill allows the agent to execute shell commands (scoped to
openspec:*) and perform file system writes (to update task completion status). - Sanitization: No explicit sanitization or content validation is performed on the data read from the context files before it is processed by the agent.
Audit Metadata