openspec-apply-change

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime the skill runs openspec instructions apply --change "<name>" --json, then “Read context files” by reading every file path listed under contextFiles and ingesting their body text into the agent; those files are outsider-authored OpenSpec artifacts (e.g., proposal/spec/design/tasks) that the operating user did not author.