ProjectWorlds can pass malicious payloads