openspec-apply
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several command-line tools to manage the implementation workflow. These include the
openspecCLI for state management,gitfor branch creation and commits, andcodegraphfor codebase exploration. It also executes the project's local Gradle wrapper (./gradlew) to perform baseline health checks. - [REMOTE_CODE_EXECUTION]: By running the local Gradle wrapper (
./gradlew), the skill executes build scripts defined within the repository. This is a standard part of the development workflow but involves executing code that is not part of the skill itself. - [INDIRECT_PROMPT_INJECTION]: The skill relies on parsing and implementing tasks described in external files such as
tasks.mdandproposal.mdfound in the user's repository. - Ingestion points: Processes task descriptions, design specifications, and proposal artifacts from the repository as instructions for implementation (SKILL.md steps 5 and 9).
- Boundary markers: The skill does not implement specific delimiters or "ignore embedded instructions" warnings when reading these files.
- Capability inventory: The skill has the capability to modify any file in the codebase and execute shell commands through the OpenSpec, Git, and CodeGraph tools.
- Sanitization: No explicit sanitization or validation of the content within the task artifacts is performed before the agent acts upon the instructions contained within them.
Audit Metadata