canva-export
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions and logic are consistent with the legitimate task of exporting Canva designs and do not contain malicious patterns.
- [EXTERNAL_DOWNLOADS]: The skill initiates downloads of exported design files from Canva's official infrastructure, which is a standard part of the service's functionality.
- [COMMAND_EXECUTION]: Local Python scripts are executed via Bash to interact with the Canva API and manage files. This is standard behavior for this type of tool integration.
- [PROMPT_INJECTION]: A potential surface for indirect prompt injection is present because the skill processes design and folder names from Canva.
- Ingestion points: Metadata is retrieved from the Canva API through scripts like list_designs.py.
- Boundary markers: No explicit delimiters for external metadata are specified in the instructions.
- Capability inventory: The skill uses Bash to run scripts and Write to save files.
- Sanitization: The documentation does not describe specific sanitization for design names or other retrieved metadata.
Audit Metadata