openspec-apply-change
Warn
Audited by Snyk on Jun 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.75). The skill runs
openspec instructions apply --change "<name>" --json, then reads the listedcontextFilesfrom that output; those files are sourced from the OpenSpec change artifacts (e.g., proposal/specs/design/tasks) which are authored by others, so their body text can be ingested into the agent’s LLM context via the “Read context files” step.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata