hunting-for-beaconing-with-frequency-analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The SKILL.md workflow explicitly requires enrichment against public third‑party sources (e.g., "Check identified beaconing destinations against VirusTotal, WHOIS registration data, certificate transparency logs, and passive DNS history" in the Workflow/Step 7) and those external results are used to score and prioritize findings, so untrusted external content can materially influence decisions.