rivet-agentos

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The only outsider-authored free text handled at runtime in this skill is user/client-provided prompts passed into the in-VM agent sessions (e.g., workflows.ts run input issue/repo), and there is no evidence of the workflow ingesting unsolicited outsider text from a monitored queue/feed or reading third-party authored sources without an explicit select/search step.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Browse.sh catalog URL (https://browse.sh) is referenced in the browse CLI skill documentation and the skill explicitly documents runtime commands ("browse skills add/install") that fetch and install remote site‑specific skills which then become available to agents and can alter agent behavior, so this is a runtime external dependency that can inject instructions/code into the agent.