openspec-apply

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several command-line tools to manage the implementation workflow. These include the openspec CLI for state management, git for branch creation and commits, and codegraph for codebase exploration. It also executes the project's local Gradle wrapper (./gradlew) to perform baseline health checks.
  • [REMOTE_CODE_EXECUTION]: By running the local Gradle wrapper (./gradlew), the skill executes build scripts defined within the repository. This is a standard part of the development workflow but involves executing code that is not part of the skill itself.
  • [INDIRECT_PROMPT_INJECTION]: The skill relies on parsing and implementing tasks described in external files such as tasks.md and proposal.md found in the user's repository.
  • Ingestion points: Processes task descriptions, design specifications, and proposal artifacts from the repository as instructions for implementation (SKILL.md steps 5 and 9).
  • Boundary markers: The skill does not implement specific delimiters or "ignore embedded instructions" warnings when reading these files.
  • Capability inventory: The skill has the capability to modify any file in the codebase and execute shell commands through the OpenSpec, Git, and CodeGraph tools.
  • Sanitization: No explicit sanitization or validation of the content within the task artifacts is performed before the agent acts upon the instructions contained within them.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 05:52 PM
Security Audit — agent-trust-hub — openspec-apply