analyzing-sbom-for-supply-chain-vulnerabilities

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow ingests SBOM JSON files (CycloneDX/SPDX) that are explicitly described as “vendor-provided SBOMs”/“vendor SBOMs” in the runtime scenario, and those SBOMs are outsider-authored free-form text that the agent parses into LLM context (e.g., component fields like names/versions/CPEs/PURLs and any embedded text fields).