canva-presentation-time-fitting
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text data extracted from Canva presentation slides, which could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: The skill extracts visible slide text in
SKILL.md(Step 4) via theCanva:get-design-contenttool. - Boundary markers: The instructions do not specify the use of delimiters or specific instructions to the agent to disregard any commands embedded within the slide text.
- Capability inventory: The agent has the ability to write new content (speaker notes) back to a Canva design using
Canva:perform-editing-operationsandCanva:commit-editing-transaction(SKILL.mdStep 7). - Sanitization: No explicit sanitization or validation of the slide content is described before it is used for note generation.
Audit Metadata