openspec-apply-change

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md:46-50 requires reading “context files” whose paths come from openspec instructions apply --json output (contextFiles), which can include outsider-authored repo content (e.g., issues/PRs/wiki/discussion artifacts in the OpenSpec change) that is then ingested as readable text into the agent’s LLM context.