scroll-world

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is ingested at runtime via the user-configured config.sections[*].title/body/tags/label/cta fields that the engine renders into DOM using innerHTML in references/scrub-engine.js, creating an indirect prompt/script-injection exposure path.