canvas-design
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill instructions are centered on aesthetic document generation (PDF, PNG, MD) and do not request elevated privileges, network access, or sensitive file system operations.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user instructions to derive a conceptual thread for the artwork. While this provides a surface for injection, the skill's capabilities are limited to generating static visual content, which significantly mitigates potential impact. Evidence Chain: Ingestion points (user input foundations in SKILL.md), Boundary markers (Absent), Capability inventory (Creation of .md, .pdf, and .png files), Sanitization (Absent).
- [EXTERNAL_DOWNLOADS]: The skill references several font license files and suggests downloading additional fonts. These references target established repositories and vendors, such as Vercel and Google Fonts, and are consistent with the skill's primary purpose of design.
- [DYNAMIC_EXECUTION]: The instructions direct the agent to 'go back to the code' to refine artistic output. This implies the generation of local scripts to produce the canvas. This behavior is restricted to the local environment for the purpose of art generation and represents low risk.
Audit Metadata