canvas-data-fetching

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill fetches and renders content from external Drupal JSON:API endpoints (e.g., the useSWR example fetching "https://my-site.com/api/user" and JsonApiClient queries using CANVAS_SITE_URL/CANVAS_JSONAPI_PREFIX), so the agent ingests untrusted public third-party content as part of its workflow.