vmos-edge-flowsmith

BENIGN for provenance and data flow, but HIGH RISK in use: the skill is internally consistent with VMOS Edge automation, uses vendor-documented local endpoints, and shows no clear exfiltration or malware behavior. The main concern is autonomy abuse because it explicitly supports large-scale account actions like bulk messaging, registration, and farming on real devices/accounts.

No explicit malware payload is evidenced within the snippet (no reverse shell/process spawning or hardcoded real secrets). However, the configuration documents a high-capability automation workflow that can (a) capture screenshots, (b) read on-screen text, (c) manipulate device state, and most importantly (d) perform authenticated outbound HTTP requests that include a Bearer token and a phone number. Combined with unusually permissive/opaque httpRequest retry/success behavior, this creates a meaningful risk of privacy/data exfiltration or account/API abuse if the runtime variables and destinations are not strictly controlled. Treat as security-sensitive automation logic requiring strong scrutiny of TOKEN/PHONE sourcing and the real API endpoint/receiver.