building-super-timelines-with-plaso

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow invokes Plaso extraction/export (log2timeline.py → psort.py/psteal.py) over a user-supplied forensic source such as a mounted image/directory (scripts/agent.py: extract/psteal), and that tool ingests free-text fields originating from the image/artifacts themselves, which an outsider could have authored (e.g., logs/browsers/user content inside the evidence).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes and may runtime-pull/run the remote Docker image referenced at https://hub.docker.com/r/log2timeline/plaso (used via "docker pull" / "docker run log2timeline/plaso"), which would execute remote code inside the container.