alert-analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow queries ServiceNow ITOM Event Management tables like em_alert and evt_mgmt_alert_actions (e.g., GET /api/now/table/em_alert?... with fields including description), where alert records are ultimately created from external event payloads and thus can contain outsider-authored free text.