canva-folder-organizer
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute local Python scripts (e.g.,
create_folder.py,move_item.py) for Canva API interactions. These operations are scoped to the intended functionality of organizing account assets. - [DATA_EXPOSURE]: Log files and project structure snapshots are saved to the local
output/folders/directory. This serves as a legitimate audit trail for the user and does not involve unauthorized data exfiltration. - [INDIRECT_PROMPT_INJECTION]: As the skill ingests external data (folder names and design titles from Canva), it is theoretically susceptible to indirect prompt injection. However, the mandatory 'Clarify' phase and human-in-the-loop requirement for implementation act as effective mitigations against unauthorized automated actions.
Audit Metadata