sap-extension-creator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the extension frontend index.html, the WebSocket handler calls render(d.data.messages) on messages_update/broadcast_messages without selecting any specific item first, so user-supplied chat text can be ingested as free text at runtime.