ov-resources

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The ov skill ingests outsider-authored free text via the runtime workflow path ov add-resource → “URL/Git repo” (including watch-triggered re-imports), which imports untrusted content into viking://resources/ where the agent can later read/search it.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill documents and instructs use of destructive filesystem commands (rm --recursive, write) and explicitly notes that import/export/backup/restore require ROOT/ADMIN, which could push an agent to request or attempt elevated privileges and modify system state.