dot-canvas-designer
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or persistence mechanisms were detected in the skill files.
- [PROMPT_INJECTION]: The skill ingests untrusted data into templates via the inputData object (referenced in SKILL.md and windowdata.md), creating a theoretical surface for indirect prompt injection. However, this risk is mitigated as the skill has no functional tools or capabilities enabled (tools: [] in agents/openai.yaml). Furthermore, the documentation provides sanitization by explicitly banning dangerous keys such as dangerouslySetInnerHTML, proto, and prototype.
- [DATA_EXFILTRATION]: The skill follows the principle of least privilege by explicitly instructing the agent to avoid handling API keys or device identifiers, directing those operations to a separate tool.
Audit Metadata