vendor-cert-acceptance

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow (“Certification Evaluation for New Vendor”, Step 2) ingests outsider-authored free text from vendor-provided certification materials (e.g., SOC 2 reports under NDA, certificate scope statements, and verification notes) that the operating user did not author, and the LLM context would include that prose when evaluating authenticity/scope.