3d-building-mechanics

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/building-network-manager.js.md, the client ingests outsider-authored free text via the WebSocket onmessage path (JSON.parse(event.data) in BuildingNetworkClient.connect) and passes the resulting fields (e.g., message.reason, message.error, piece/material strings) into prediction/state update handlers.