canva-automation
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the Canva environment.
- Ingestion points: Design titles and search results from
CANVA_LIST_USER_DESIGNS(SKILL.md), and template placeholders/metadata fromCANVA_ACCESS_USER_SPECIFIC_BRAND_TEMPLATES_LIST(SKILL.md). - Boundary markers: The instructions do not define clear delimiters or "ignore instructions" wrappers when the agent processes retrieved design or template names.
- Capability inventory: The skill possesses capabilities to create/modify designs, move items between folders, and perform network-based asset uploads via
CANVA_CREATE_ASSET_UPLOAD_JOB(SKILL.md). - Sanitization: There is no evidence of sanitization or validation logic to filter out instructional text embedded in design titles or template data.
- [EXTERNAL_DOWNLOADS]: The skill requires the configuration of an external MCP server endpoint at
https://rube.app/mcpto provide the tool definitions, which introduces a dependency on an external service provider.
Audit Metadata