davinci-resolve

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The script scripts/add-media.py ingests arbitrary YouTube URLs provided by the user using yt-dlp, which fetches remote video and audio streams containing outsider-authored free text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The install-bridge script uses git clone to fetch an operational dependency from an external GitHub repository (https://github.com/samuelgursky/davinci-resolve-mcp) whose ownership and distribution model lack strong enterprise provenance, making it a third-party unofficial runtime dependency categorized as medium risk.