secops-triage

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill instructs the agent to inject usage attribution headers and environment variables into external tool commands, which constitutes undisclosed tracking activity that acts on the user's behalf in ways they would not expect.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow for secops-triage consumes security alerts, SOAR cases, and log telemetry via tools like get_case, list_cases, get_security_alert, and search_udm, which contain outsider-submitted alert descriptions, raw log payloads, and user comments.