excalidraw-mcp-diagramming

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill requires calling the external Excalidraw MCP server (e.g., read_diagram_guide from the configured https://mcp.excalidraw.com and describe_scene/get_canvas_screenshot of the persistent canvas) and must read and obey server-provided colour/sizing rules and live canvas contents, which are third-party/persistent user-generated data that can change agent decisions and subsequent tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill requires and calls the external MCP server at https://mcp.excalidraw.com at runtime (e.g., read_diagram_guide()) and that server-provided guide/values directly control the agent's diagram-generation instructions and are a required dependency.