openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
openspecCLI tool for several management tasks, including discovering stores, listing active changes, and retrieving implementation instructions. These commands are executed locally using parameters derived from the environment or user input. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from the local file system and tool outputs which could contain adversarial instructions.
- Ingestion points: The agent is directed to read the contents of files specified in the
contextFilesmetadata (e.g., proposal, specs, design, tasks) and parse JSON output from theopenspecCLI. - Boundary markers: The instructions do not define specific delimiters or instructions for the agent to disregard potential AI commands embedded within the artifacts it reads.
- Capability inventory: The skill has read/write access to repository files for task tracking and the ability to execute the
openspeccommand-line utility. - Sanitization: There is no explicit sanitization or validation logic described for the data retrieved from context files or CLI responses before it is integrated into the agent's context.
Audit Metadata