craft-ui

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). In render mode, the runtime server accepts user/outsider-authored free text via the Alt+click comment overlay (textarea), posts it to POST /event as { type: "comment", text: <user text> }, and the skill then uses the recorded events to drive subsequent LLM turns (comment text can be included in agent context for addressing the comment).