bevy-assets

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Asset loading occurs via Bevy’s AssetServer/Reader pipeline (e.g., loading *.glb/textures and parsing GltfExtras JSON) and the workflow then reads parsed authored text from those assets at runtime (e.g., in react_to_loads/WorldInstanceReady), so outsider-authored content embedded in user-provided asset files can be ingested.