detecting-sql-injection-via-waf-logs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow ingests WAF log files provided via --log-file (e.g., ModSecurity audit logs / AWS WAF JSON / Cloudflare events), which are outsider-authored textual content from external systems/parties and can include attacker-supplied free text (e.g., request URIs/payloads) that the agent parses into LLM context.