openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute various
openspecCLI commands (status,list,instructions, etc.) to manage implementation workflows and task states. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted data from the local repository into the agent's decision-making process.
- Ingestion points: The agent reads and acts upon data from the
context,operationGuidance, and specific file paths listed in thecontextFilesarray returned by theopenspecCLI. - Boundary markers: The instructions provide guidelines for the agent to separate CLI-controlled state from external guidance and to report conflicts between the two, which acts as a logical boundary.
- Capability inventory: The agent has the ability to execute shell commands (via
Bash(openspec:*)) and modify local source code and task tracking files. - Sanitization: There is no evidence of programmatic sanitization or verification of the content within the ingested files or CLI-returned guidance strings.
Audit Metadata