speckle-impl-viewer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill explicitly resolves and loads models from public Speckle URLs using UrlHelper.getResourceUrls and SpeckleLoader (see SKILL.md and references/examples.md examples like https://app.speckle.systems/...), and the loaded, user-generated model data and properties (via viewer.getObjectProperties) are then read and used to drive filtering, selection, camera framing, diffs, and other actions, so untrusted third-party content can materially influence runtime behavior.