building-super-timelines-with-plaso

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required runtime workflow ingests outsider-authored evidence text from the user-supplied forensic source (e.g., /cases/.../image.E01 mounted into the container) via log2timeline.py parsers, which can extract arbitrary free-form strings from that evidence into the .plaso/export that is then imported into the agent’s LLM context (indirectly through generated timeline text/JSONL/CSV).