canva-deploy-integration

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes official CLI tools for Vercel (vercel), Fly.io (fly), and Google Cloud (gcloud) to manage secrets and deploy applications. These commands are integral to the skill's stated purpose of platform deployment.
  • [EXTERNAL_DOWNLOADS]: The skill references official domains and API endpoints for well-known services, including canva.com, vercel.com, fly.io, and cloud.google.com. These are used for documentation, API health checks, and service integration.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a vulnerability surface by processing untrusted data from external sources.
  • Ingestion points: The script api/canva/callback.ts processes code and state parameters from URL query strings, and api/health.ts processes responses from the Canva API.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are included in the provided code snippets.
  • Capability inventory: The skill is configured with Bash tools for deployment and has file system access (Read, Write, Edit).
  • Sanitization: The provided boilerplate examples do not demonstrate explicit validation or sanitization of ingested data before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 06:40 AM