canvas
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external Model Context Protocol (MCP) sources, such as Datadog, Sentry, and Slack, to generate visual artifacts. This creates a surface for indirect prompt injection where malicious content in those external sources could influence the agent's behavior during artifact creation.
- Ingestion points: External tool data retrieved via MCP (SKILL.md).
- Boundary markers: The instructions do not mandate the use of delimiters or boundary markers to isolate untrusted data.
- Capability inventory: The agent utilizes file system write access to create .canvas.tsx files (SKILL.md).
- Sanitization: The skill does not explicitly instruct the agent to sanitize or escape external content before rendering it in the UI.
- [DATA_EXFILTRATION]: The skill directs the agent to interact with files inside a hidden application configuration directory in the user's home folder.
- Evidence: The skill defines the primary storage path as
/Users/<user>/.cursor/projects/<workspace>/canvases/(SKILL.md). While this is the intended location for this specific IDE feature, it involves interaction with sensitive home directory subfolders.
Audit Metadata