querying-canvas-data
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill documents a platform-provided SDK (@posthog/canvas-sdk) that operates within a restricted sandbox where direct network access is blocked and external resources must be declared in capabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of third-party data via connectors (GitHub, MCP servers) which could theoretically be used for injection; however, the architecture described includes robust mitigations such as mandatory viewer approval for agent requests and write operations.
- Ingestion points: ph.connectors.call, ph.loadInsight, and ph.query.
- Boundary markers: The host-injected SDK requires a user gesture and explicit viewer approval via a system dialog for ph.agent.request and ph.tools.call.
- Capability inventory: ph.actions.invoke, ph.tools.call, ph.agent.request, and ph.navigate, all governed by explicit capability allowlists.
- Sanitization: The guide encourages verifiability through direct links to source insights and the disclosure of ad-hoc queries, ensuring viewers can inspect the provenance of any displayed metric.
Audit Metadata