canva-incident-runbook
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates legitimate operational tasks such as triaging API errors and monitoring service health for a well-known provider (Canva).
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform diagnostic operations, including checking API status with curl and retrieving application logs via kubectl. These commands are appropriately scoped to the stated purpose of incident triage and mitigation.
- [CREDENTIALS_UNSAFE]: Authentication is handled correctly by referencing environment variables (e.g., $CANVA_ACCESS_TOKEN, $TOKEN) rather than hardcoding secrets or providing instructions to store them unsafely.
- [INDIRECT_PROMPT_INJECTION]: Although the skill processes external data by reading kubectl logs, it includes mandatory instructions for the agent to redact sensitive fields, opaque identifiers, and user content, effectively mitigating the risks associated with processing untrusted data in an incident response context.
Audit Metadata