openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing local shell commands via the
openspecCLI tool to manage change tasks, specifically using commands likeopenspec list,openspec status, andopenspec instructions apply. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests external file content and dynamic instructions while possessing the ability to modify files and execute CLI commands.
- Ingestion points: The skill reads multiple files specified by the CLI output (under
contextFiles), including proposals, design documents, and task lists, as well as a 'dynamic instruction' field. - Boundary markers: There are no explicit instructions to use delimiters or ignore embedded commands when reading these context files or the dynamic instructions.
- Capability inventory: The skill can execute shell commands via the
openspecCLI and perform file write operations to update task checklists. - Sanitization: The skill lacks explicit sanitization steps for the content ingested from the project files or the dynamically generated instructions.
Audit Metadata