joker-sims-parser

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In interactive.go, the REPL reads arbitrary terminal user text into the input string, then dispatches commands like parse, list, and info that open and parse attacker-supplied local Sims DBPF files; the injection surface is therefore outsider-authored free text passed directly as runtime command arguments (file paths/directories) for parsing.