nsm-ids-triage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The NSM IDS triage required workflow reads a .pcap/.pcapng capture file already on disk via the nsm_alerts/nsm_status tools, not arbitrary outsider-authored free text from a queue/feed/email/chat, so the LLM runtime ingestion is limited to the provided capture content rather than unsolicited text submission.