scroll-scrubbed-word-reveal

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In demo/index.html, the skill/runtime logic reads and tokenizes free-text from a specific DOM element ([data-reveal]) via a TreeWalker and node.nodeValue.split(...), meaning any outsider-authored HTML/text placed into that element would be ingested at runtime.