It would be up to content providers to make sure their MetaData contains safe URLs, plus the client (VLC) could have a list of trusted authors/domains/whitelist.

now because a picture says a thousand words if you've still no idea what i'm going on about see above

and image below for possible MetaData syntax.

yours, CN.