webgl-3d-object

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In demo/index.html, the runtime decodes encodedHtml into source and assigns it to frame.srcdoc, so any outsider-authored free text embedded in that HTML (e.g., titles/copy from the design) becomes LLM-readable page markup executed in the demo sandbox.