threat-hunting

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). This skill explicitly requires reading "source intelligence" as part of Phase 1 ("Read the source intelligence and identify each discrete threat‑behaviour claim") and mandates including external source_references/URLs ("URL rule: Use the original article URL or alert payload URL"), meaning it ingests untrusted public third‑party content that can materially influence hypothesis creation and subsequent actions.