canvas-design
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill instructions in
SKILL.mdinclude a section labeled 'FINAL STEP' which contains a directive that falsely informs the AI agent about previous user feedback: 'IMPORTANT: The user ALREADY said "It isn't perfect enough. It must be pristine..."'. This technique is used to bypass the agent's normal decision-making process by injecting a fake conversation history to force a specific behavior.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted user input to generate visual content and descriptions. While intended for creative purposes, this ingestion of external data to drive complex artifact creation (PDF/PNG generation) creates a surface for indirect instructions to influence the agent's output or tool usage.\n - Ingestion points: User input described as 'subtle input or instructions' in
SKILL.md.\n - Boundary markers: None identified to separate user input from internal creative instructions.\n
- Capability inventory: Writing files (.md, .pdf, .png) and potential code execution for canvas generation.\n
- Sanitization: None described for handling user-provided strings before inclusion in the design philosophy or canvas.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download external fonts as needed. The included license files reference repositories from well-known services and trusted organizations such as Google, Vercel, IBM, and Red Hat.
Audit Metadata