hunting-for-dns-based-persistence

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow queries SecurityTrails API and executes local dig commands for DNS record analysis, which involve API responses and DNS resolution data rather than continuous outsider-authored free text feeds.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The script queries the SecurityTrails API at runtime using hardcoded endpoints to fetch DNS history and subdomain data, establishing an inbound dependency on an external service.