openspec-apply-change

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill runs openspec instructions apply --json, then reads every file path listed under contextFiles and ingests their contents into the agent context; those context files are derived from the OpenSpec change artifacts (e.g., proposal/specs/design/tasks), which are not guaranteed to be authored by the operating user, so outsider-authored free text can be loaded at runtime via the apply instructions → contextFiles → file reads.