triaging-vulnerabilities-with-ssvc-framework

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and ingests public third‑party feeds (e.g., the CISA KEV JSON feed at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json and the FIRST EPSS API at https://api.first.org/data/v1/epss) and uses those untrusted API responses to determine exploitation status and drive SSVC decisions and remediation actions (see SKILL.md and scripts/process.py), so external content can materially influence agent behavior.