openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to interact with the local environment via the
openspeccommand-line tool. It uses commands such asopenspec list,openspec status, andopenspec instructionsto retrieve structured JSON data about the current project state and task requirements. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface by ingesting data from external files (as defined in
contextFiles) and CLI output to guide the implementation of code changes. This is a standard functional requirement for a developer-oriented tool where project artifacts drive the agent's logic.
Audit Metadata