canva-branded-presentation
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and transform untrusted content (user text, existing Canva design content, or brief outlines) into presentation prompts. This creates a surface for indirect prompt injection where a malicious source outline could attempt to influence the agent's behavior during the generation phase.
- Ingestion points: Content is ingested from user messages, design IDs provided by the user, and content retrieved from Canva designs via the
Canva:start-editing-transactiontool. - Boundary markers: The skill does not specify the use of delimiters (e.g., XML tags or triple quotes) or provide instructions to the agent to ignore potentially malicious commands embedded within the source content.
- Capability inventory: The skill is limited to the Canva toolset, including
Canva:list-brand-kits,Canva:generate-design, andCanva:create-design-from-candidate. It does not have general shell access or arbitrary network capabilities. - Sanitization: There are no instructions provided for sanitizing or escaping user-provided text before it is interpolated into the generation query.
Audit Metadata