canva-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides implementation examples for interacting with the official Canva Connect API (
api.canva.com). These network operations are necessary for the skill's stated purpose and target a well-known service. - [INDIRECT_PROMPT_INJECTION]: The skill contains logic to ingest and process data from external Canva API endpoints, such as design titles and user metadata, which represents a standard indirect prompt injection surface.
- Ingestion points: API responses fetched via the
canvaAPIhelper function inSKILL.md. - Boundary markers: None present in this minimal boilerplate code.
- Capability inventory: Network operations via
fetchand output viaconsole.log. - Sanitization: The provided code snippets do not include explicit validation or sanitization for design content or metadata retrieved from the API.
Audit Metadata