create-canvas-kit
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a well-documented development tool designed to help developers build Copilot canvas extensions. It follows security best practices for local web servers and dependency management.
- [COMMAND_EXECUTION]: The provided scripts (
new-canvas.mjsandinstall-local.ps1) perform standard file system operations (copying files, creating directories) to scaffold projects and install the skill locally. These operations are transparent and consistent with the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: All core libraries, including Preact, htm, and Lucide icons, are vendored within the skill's directory structure. This ensures the skill functions offline and eliminates risks associated with fetching code from remote servers at runtime.
- [PROMPT_INJECTION]: The skill's instructions in
SKILL.mdare focused on guiding the AI agent to assist the user in building canvases. No attempts to override system safety guidelines or extract internal prompts were detected.
Audit Metadata