brainstorming

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the visual-companion runtime, the agent server reads user/attacker free text sent over its WebSocket (helper.js sends text: target.textContent.trim() and server.cjs parses JSON and appends event.choice to ${STATE_DIR}/events for the next LLM turn).