canva-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a developer utility for configuring automated testing environments and CI/CD pipelines.
- [CREDENTIALS_UNSAFE]: The instructions correctly guide users to store sensitive credentials in GitHub Secrets using the official
ghCLI tool. The code samples utilize appropriate placeholders (xxx) and environment variable references rather than hardcoding actual secrets. - [EXTERNAL_DOWNLOADS]: The workflow templates utilize official, well-known GitHub Actions (
actions/checkout,actions/setup-node) and standard package management commands (npm ci), which are standard for the described development workflow. - [DATA_EXFILTRATION]: Network operations described in the integration tests and token refresh logic are restricted to the official Canva API domain (
api.canva.com), which is a well-known service consistent with the skill's primary purpose. - [INDIRECT_PROMPT_INJECTION]: The skill provides static configuration templates. It does not ingest or process untrusted external data in a way that would expose the agent to prompt injection attacks; the boundary between configuration and runtime data is clearly maintained.
Audit Metadata