polyhaven-scene-builder

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow calls send('download_polyhaven_asset', ...) for HDRIs/textures/models from PolyHaven’s public free library (outsider-authored public web content), and then ingests the returned material/model data into Blender via execute_code/MCP, making it LLM-readable context through the agent’s tool responses (e.g., res.result fields and any returned text/errors).