threat-intelligence

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Contains a direct link to an executable (https://evil.com/payload.exe) hosted on a non‑trusted domain, which is a high‑risk indicator for malware distribution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Yes—Step 2’s automated collection fetches outsider-authored threat feed content from public web endpoints (e.g., CISA KEV JSON via requests.get), which is then ingested into the agent’s data structures and can be rendered as LLM-readable text in later steps.