personas-from-artifacts

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context when the operating user provides “real user messages / transcripts” (authored by other people) in Phase 2, and the skill instructs to read them to derive persona traits.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs the runtime to fetch an agent's prompt via the coval CLI (e.g., coval agents get <agent_id>), which will contact Coval's service (https://app.coval.dev) and use the fetched prompt to ground persona creation, so this external content directly controls prompts at runtime.