threat-hunter

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). SKILL.md explicitly instructs ingesting open/public threat intel and OSINT (e.g., Phase 3 "Pull latest IOC feeds: CISA Alerts, FS-ISAC/H-ISAC, commercial feeds, MISP community feeds" and Phase 5 "OSINT (manual curation)") and then uses those IOCs to drive actions (auto-blocking, IOC sweeps), so untrusted third-party content can materially influence decisions.