dreamina-canvas-quote-and-run
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
dreamina-canvascommand-line utility for operations includingnode quote,node confirm, andnode runto manage transaction state.\n- [COMMAND_EXECUTION]: Utilizesjqto extract specific fields such as the credit approval token from the JSON output of thedreamina-canvastool.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes structured JSON data returned by thedreamina-canvastool to determine subsequent agent logic and required actions.\n - Ingestion points: Output from
dreamina-canvasCLI commands as described inSKILL.md.\n - Boundary markers: The response is handled as structured JSON, which helps prevent the misinterpretation of data as instructions.\n
- Capability inventory: The skill initiates shell commands using the
dreamina-canvasandjqbinaries inSKILL.md.\n - Sanitization: Employs
jqfor precise field extraction to isolate and validate specific data points from external tool output.
Audit Metadata