brainstorming

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The visual-companion runtime writes/reads user-selected text and events via the companion server’s WebSocket flow (browser events JSON from clicks are sent to handleMessage and appended to STATE_DIR/events, which the agent would then read on the next turn), so outsider-authored free text can be ingested without selecting a specific item first.