openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is exposed to indirect prompt injection because it processes untrusted content from the local project environment and the openspec CLI.
- Ingestion points: The agent is instructed to read all files listed in the
contextFilesarray provided by the CLI, as well as thecontextandoperationGuidancefields from JSON responses. - Boundary markers: The instructions do not define specific delimiters or "ignore previous instructions" markers when reading external file content, which could allow embedded directives to influence the agent.
- Capability inventory: The skill has the capability to execute shell commands via the
openspecCLI and modify source code and task files. - Sanitization: The skill contains protective logic that requires the agent to prioritize "built-in instructions" and "controlling values" from the CLI over external
contextorguidanceif a conflict occurs, providing a layer of defense against malicious overrides.
Audit Metadata