openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several
openspecCLI commands (e.g.,openspec list,openspec status,openspec instructions) to manage the implementation workflow. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it reads and implements tasks defined in external files.
- Ingestion points: The agent reads all files listed in the
contextFilesarray (such as proposal, specs, design, and tasks) provided by theopenspec instructions applycommand. - Boundary markers: No specific delimiters or "ignore instructions" warnings are utilized when processing the content of these files.
- Capability inventory: The skill allows the agent to perform file system reads, file system writes (code changes), and command execution via the
openspecCLI. - Sanitization: There is no evidence of sanitization or validation of the task descriptions or specification content before the agent acts on them.
- Ingestion points: The agent reads all files listed in the
Audit Metadata