openspec-apply-change

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow reads contextFiles returned by openspec instructions apply --json, then reads every file path listed there; those context files are sourced from the OpenSpec change artifacts, i.e., outsider-authored free text can be ingested via the change’s submitted artifacts without an explicit “select a specific trusted item” gate beyond choosing/inferring a change.