vos-create

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md step 2, the workflow reads every outsider-authored recipe/exemplar markdown (.md bodies and exemplar configs/docs via contentUrls) from the user-selected vos.so folder, so free text submitted by the folder owner/outsider can be ingested and followed at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill issues runtime GETs to https://vos.so/api/folders/{id} and https://vos.so/vos/ (base https://vos.so/api) to pull folder recipes and exemplar configs whose content is then used to directly control the agent's authoring/instructions, so this is a remote runtime dependency that controls prompts.