canva-common-errors
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill incorporates strong data protection practices, explicitly instructing the agent to redact and exclude sensitive information—including authentication tokens, request bodies, signed URLs, and customer identifiers—from any collected evidence or output artifacts.
- [SAFE]: External documentation links point exclusively to official Canva developer resources (canva.dev), which are well-known and trusted sources for API integration guidelines.
- [SAFE]: The skill follows the principle of least privilege regarding tool usage, restricting the use of 'Write' and 'Edit' tools to approved artifacts and specifically forbidding unapproved changes to the Canva environment.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external error messages and provider codes, which technically introduces an ingestion point for untrusted data. However, the risk is effectively mitigated by the mandatory redaction steps and the 'minimal envelope' capture requirement, ensuring the agent does not process potentially malicious payload content.
Audit Metadata