vs-item-onboarding

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill explicitly instructs the agent to render and translate its internal "thinking / reasoning / planning" outputs into the user's language (including host-surfaceable scratchpads), which is a hidden/deceptive directive to reveal internal chain-of-thought outside the onboarding task and risks overriding normal system-level constraints.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The workflow runs vs dataset infer-result (step 6) and then renders and surfaces its persisted inference artifact via vs dataset validate-schema (step 7), which causes the LLM to include outsider-authored free text from the imported source data/metadata in the CLI stdout that is copied verbatim into the agent context (e.g., schema field names/descriptions derived from user-provided JSONL/CSV/MySQL content and distinct event_type values).