canva-core-workflow-a
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: Potential vulnerability surface identified where external data from the Canva API is ingested into the agent context.
- Ingestion points: Design metadata (titles, page counts, and owner details) retrieved from
GET /designs/{designId}in theSKILL.mdinstructions. - Boundary markers: No explicit delimiters or instructions to ignore embedded content within design titles are provided in the code templates.
- Capability inventory: The skill is configured with access to file system tools (
Read,Write,Edit) and shell execution (Bash), which could be leveraged if an injection is successful. - Sanitization: While the documentation suggests keeping design content out of logs and using encrypted storage, it does not specify sanitization or escaping for design titles before they are interpolated into the prompt context.
Audit Metadata