implementing-stix-taxii-feed-integration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text is ingested when the required runtime workflow polls a TAXII collection and reads the returned STIX JSON objects (including fields like name, pattern, labels, etc.) into the program’s in-memory data structures via Collection.get_objects/as_pages, which are then parsed/extracted and could be forwarded into an LLM context by downstream reporting/integration steps.