openspec-apply-change

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The runtime path uses openspec instructions apply --change "<name>" --json to obtain contextFiles, then reads those files’ contents into the agent (step 4), and those files are outsider-authored because they come from OpenSpec artifacts the operating user did not author (e.g., proposals/specs/design/tasks stored in the change repository).