dreamina-canvas-discover-models

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the agent to execute multiple shell commands using the dreamina-canvas binary (e.g., model search, voice list, version, schema) to retrieve live configuration and capability data from the system.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret structured data (JSON) returned by the dreamina-canvas CLI, creating a surface for indirect prompt injection if the tool output were to be manipulated.
  • Ingestion points: Data enters the agent context through the stdout of dreamina-canvas discovery commands in SKILL.md and references/capability-discovery.md.
  • Boundary markers: The instructions lack explicit delimiters or warnings to the agent to disregard instructions potentially embedded within the CLI's JSON responses.
  • Capability inventory: The skill utilizes shell command execution via a specific binary across all reference and skill files.
  • Sanitization: There are no documented steps for validating or sanitizing the content of the discovery payload before it is used to populate arguments for further command execution.
  • [DYNAMIC_EXECUTION]: The instructions establish a dynamic workflow where the agent must inspect the output of a schema command to decide which subcommands (e.g., model search vs model list) and flags are appropriate to use at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 02:20 AM