openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing multiple subprocess commands via the
openspecCLI (e.g.,openspec status,openspec list, andopenspec instructions) to retrieve state and metadata for the implementation process. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes content from external project artifacts that could be controlled by an attacker.
- Ingestion points: The agent reads files identified in the
contextFileslist provided by the CLI (e.g.,proposal,specs,design,tasks) and parses JSON output from CLI commands. - Boundary markers: Absent. There are no instructions to use delimiters or ignore embedded natural language instructions within the processed files.
- Capability inventory: The skill has permission to execute shell commands (
openspec) and perform file system modifications (writing code changes and updating task checkboxes). - Sanitization: None. The skill lacks validation or sanitization of the content found within the context files before using it to guide implementation logic.
Audit Metadata