kelly-revshare-simulator

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In content/kelly-revshare-simulator-app/app/app.js the UI calls loadState() → provider.getState(), and in the Busabase runtime path content/kelly-revshare-simulator-app/app/js/providers/busabase-provider.js getState() reads all scenarios and settings records via records.list, so outsider-authored free text in analyst-controlled Busabase fields (name, business-type, decision-note, payload JSON) is ingested and rendered at runtime.