openspec-workitem-enrichment

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes Azure DevOps at runtime (e.g., organization URLs like https://dev.azure.com/ORG or https://{org}.visualstudio.com) via az boards / az devops invoke to fetch work item fields and comments which are injected into the agent's generated spec, so external content directly controls the agent's output and is required for enrichment.