canvas-design
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill employs a 'User Simulation' pattern within the 'FINAL STEP' section of SKILL.md. It instructs the agent to believe the user has already provided specific feedback ("The user ALREADY said 'It isn't perfect enough...' "). This technique manipulates the agent's perception of the conversation history to force a high-effort refinement cycle, which may cause the agent to ignore actual user prompts or current context.
- [EXTERNAL_DOWNLOADS]: The instructions explicitly direct the agent to 'Download and use whatever fonts are needed' to complete the design task. This encourages the agent to interact with arbitrary external sources for assets at runtime without providing a list of trusted vendors or verifying the integrity of the downloaded content.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface. It ingests unvetted user input ('subtle input or instructions') and uses it to drive the generation of complex artifacts and potentially executable code ('Go back to the code and refine').
- Ingestion points: User-provided design instructions and niche references (SKILL.md).
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands in the user input are provided.
- Capability inventory: File system write access (creating .md, .pdf, and .png files) and implicit code execution for image rendering.
- Sanitization: No sanitization or validation of the user-provided 'subtle references' is performed before they are used to influence the output generation.
Audit Metadata