cold-email-lemlist

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill fetches prospect data and company profiles using Vibe Prospecting, which ingests outsider-authored company descriptions, job titles, and firmographic data into the agent's runtime context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the execution of an npx package (@vibeprospecting/vpai@latest) via npm from an external registry during setup and runtime, which constitutes an unverifiable external runtime dependency with unknown/third-party provenance.