dependency-vulnerability-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow is to run real vulnerability scanners (e.g., npm audit, pip-audit, govulncheck, cargo audit, bundle audit) and then have the LLM analyze the resulting findings; those scanner outputs are free-form text originating from public vulnerability databases/registries at runtime, which can include untrusted descriptions and thus can be fed into the LLM context.