analyzing-apt-group-with-mitre-navigator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Yes—scripts/agent.py downloads outsider-authored free text/JSON from a public GitHub raw URL (requests.get(ATTACK_ENTERPRISE_URL)), then parses it and injects fields like obj.get("description", "") and technique names into the generated Navigator layer that is subsequently used as LLM context/output.