json-canvas
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions involve reading and parsing potentially untrusted data from existing .canvas files.
- Ingestion points: Workflow steps in
SKILL.md(e.g., "Add a Node to an Existing Canvas" and "Edit an Existing Canvas") instruct the agent to read and parse the existing .canvas file as JSON. - Boundary markers: The instructions lack explicit delimiters or guidance to treat node content (such as the
textfield in text nodes or thelabelfield in edges/groups) as non-executable data, potentially allowing embedded instructions to influence the agent's behavior. - Capability inventory: The skill enables the agent to perform file system operations (read and write) based on the structure and content of these JSON files.
- Sanitization: While the instructions emphasize JSON validation and ID uniqueness, they do not provide measures to sanitize the markdown or text content within the nodes to prevent prompt injection attacks.
Audit Metadata