openspec-apply-change
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the
openspecCLI by executing commands such asopenspec list,openspec status, andopenspec instructions. It uses variable interpolation for the change name (e.g.,openspec status --change "<name>" --json), which requires the agent to ensure input names do not contain shell metacharacters. - [DATA_EXFILTRATION]: The skill reads project documentation, specifications, and source code files listed in the
contextFilesoutput of the CLI. This is a core part of the functionality but involves reading local file system data. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its implementation logic is driven by the content of external task files and context files.
- Ingestion points: CLI output from
openspec instructionsand local project files specified incontextFiles(SKILL.md). - Boundary markers: There are no explicit delimiters or instructions to ignore embedded prompts within the files being read.
- Capability inventory: Shell command execution via the
openspecCLI and the ability to read and write to the local file system to implement code changes (SKILL.md). - Sanitization: The skill does not implement sanitization or validation of the content retrieved from project files before using it to guide agent behavior.
Audit Metadata