canva-deploy-integration
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes official CLI tools for Vercel (
vercel), Fly.io (fly), and Google Cloud (gcloud) to manage secrets and deploy applications. These commands are integral to the skill's stated purpose of platform deployment. - [EXTERNAL_DOWNLOADS]: The skill references official domains and API endpoints for well-known services, including
canva.com,vercel.com,fly.io, andcloud.google.com. These are used for documentation, API health checks, and service integration. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a vulnerability surface by processing untrusted data from external sources.
- Ingestion points: The script
api/canva/callback.tsprocessescodeandstateparameters from URL query strings, andapi/health.tsprocesses responses from the Canva API. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are included in the provided code snippets.
- Capability inventory: The skill is configured with
Bashtools for deployment and has file system access (Read,Write,Edit). - Sanitization: The provided boilerplate examples do not demonstrate explicit validation or sanitization of ingested data before processing.
Audit Metadata