openspec-verify-change

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill runs openspec instructions apply --change "<name>" --json and then “read all available artifacts from contextFiles”; those artifacts (e.g., tasks.md, delta specs, design.md) are outsider-authored change artifacts from the openspec/changes/<name>/... directory, which the operating user did not author/choose at runtime, so their readable text can be injected into the agent’s LLM context.