dt-sec-ioc-hunting

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In references/hunt-logs.md the runtime uses untrusted IoCs extracted from user/pasted advisory text or fetched advisory content to build fetch logs DQL filters that ingest Dynatrace log content, and then references/hunt-logs.md/references/secondary-observable-extraction.md instruct the LLM to read that content (free text) to extract secondary IPs for re-hunting.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires the orchestrating agent to fetch advisory web pages at runtime and then extract IoCs from the fetched content (which directly controls hunt queries/agent behavior); an example literal URL present in the content is http://microsoft-symantec.art:8848/?h=microsoft-symantec.art&p=8848&t=tcp&a=w64&stage=true.