render-mosaic-grid-reveal

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow renders a first-party generated HTML scene from a user-supplied config.json and directly injects outsider-authored free text fields like tile[].name, eyebrow, and end_card (sub, tagline_top, tagline_bottom, cta, url) into the DOM that Playwright screenshots, so prompt-injection style text could be ingested.