openspec-apply-change
Warn
Audited by Snyk on Jul 3, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.65). The skill runs
openspec instructions apply --jsonand then “Read context files” fromcontextFiles; those files are sourced from the OpenSpec change artifacts (e.g., proposal/specs/design/tasks) which are not guaranteed to be authored by the operating user, so outsider-authored free text can be ingested into the LLM via the file contents at runtime.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata