canva-visual-assets

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow uses stock image search APIs (Pexels, Unsplash, Pixabay) where search queries and selected image results are retrieved, but stock image metadata/descriptions are not monitored input feeds or feeds posted to by outsiders.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The referenced personal GitHub repository for imagebank-mcp provides setup instructions and an unverified personal codebase used to configure a runtime MCP server, constituting an unofficial operational dependency.