canvas-design
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The SKILL.md file contains instructions that simulate a user prompt to alter the agent's behavior. In the section 'FINAL STEP', the instruction 'IMPORTANT: The user ALREADY said' is used to force the agent into an improvement phase by hallucinating previous user dissatisfaction.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions that may result in the agent fetching external assets from the internet. In the 'CANVAS CREATION' section, the instruction 'Download and use whatever fonts are needed to make this a reality' encourages the agent to perform network operations to obtain third-party files without specifying or verifying the sources.
Audit Metadata