create-canvas-app

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Yes — several listed URLs target link-local cloud metadata (169.254.169.254) and loopback hosts (127.0.0.1 / localhost), which are high-risk SSRF/internal-access vectors and not safe download sources.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). In the runtime’s kit/server.mjs, both agent-invoked and UI-invoked actions accept input from POST /action/invokeFromAgent, but the skill itself does not describe any required ingestion of outsider-authored free text without the canvas author explicitly choosing it (e.g., there is an untrusted external fetch pattern, yet outsider text is only ingested after the author selects a URL/source).