canvas-hardened

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill exposes multiple high-risk abuse surfaces — serving arbitrary HTML to remote nodes, executing arbitrary JavaScript in their WebViews (eval), injecting a live-reload WebSocket client, taking screenshots (snapshot), and binding the host to network interfaces — all of which enable credential-phishing, data exfiltration, remote control/backdoor channels, and surveillance even if no explicit obfuscated malware is present.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly allows presenting/navigating to arbitrary full URLs (see the "present" and "navigate" actions with target:/url:) and includes an "eval" action to run JS in the canvas WebView, so the agent can load and interact with untrusted public web content (external URLs) served to nodes, which could carry instructions that influence subsequent tool actions.