dreamina-canvas-cli-setup
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of installation scripts from official Jianying and Bytedance domains (jimeng.jianying.com and bytednsdoc.com). These scripts are intended to install the Dreamina Canvas CLI on macOS, Linux, and Windows. The instructions prioritize obtaining explicit user consent before any script is executed.
- [COMMAND_EXECUTION]: The skill utilizes the
dreamina-canvasbinary andnpxto perform setup tasks, version checks, and schema verification. It instructs the agent to run subcommands such asauth login,auth account,version, andschemato confirm the environment's readiness. - [INDIRECT_PROMPT_INJECTION]: The skill processes outputs from external tools and CLI commands during the setup phase. While it includes checks for command availability and version strings, it relies on the integrity of the data returned by these external binaries to determine its next steps.
- [PRIVILEGE_ESCALATION]: The skill includes instructions for modifying the system
PATHto ensure the CLI is accessible. It explicitly states that these modifications must not be performed silently and require the user's approval, adhering to best practices for system changes.
Audit Metadata