canva-performance-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructs the agent to establish performance baselines and identify bottlenecks using standard discovery tools (Read, Grep) without attempting to bypass security constraints.
- [INDIRECT_PROMPT_INJECTION]: The skill processes application evidence and logs to identify performance issues. While logs represent a potential ingestion point for untrusted data, the instructions prioritize established baselines and approved synthetic data, minimizing the risk of accidental execution of embedded instructions.
- Ingestion points: Application evidence, provider calls, and latency distributions (SKILL.md, Step 1).
- Boundary markers: Encourages use of "synthetic or approved data."
- Capability inventory: Write and Edit tools are scoped to changing configuration/code behind feature flags (SKILL.md, Step 3).
- Sanitization: Relies on human-in-the-loop review for experiment design and validation.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and OpenAPI contracts from
canva.dev, which is the official developer domain for the service and is treated as a well-known service source.
Audit Metadata