openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes external project artifacts (e.g., specifications, design documents, and task lists) to guide the agent's implementation steps. This creates a surface for indirect prompt injection if these files contain malicious instructions.
- Ingestion points: Content from files listed in the
contextFilesmetadata provided by theopenspec instructions applycommand. - Boundary markers: The skill does not explicitly define delimiters to separate input data from instructions, although it uses a structured loop for implementation.
- Capability inventory: The skill is authorized to execute
openspecCLI commands via Bash and perform file-system modifications for code implementation. - Sanitization: No specific text sanitization or filtering is applied to the ingested content.
- [COMMAND_EXECUTION]: The skill is configured with a restricted toolset (
Bash(openspec:*)), ensuring that the agent can only execute commands related to the OpenSpec ecosystem, which aligns with the principle of least privilege.
Audit Metadata