validating-and-publishing-canvases
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages canvas source projects which may contain external or user-provided files, creating a potential surface for indirect prompt injection if the agent processes malicious instructions within those files.
- Ingestion points: Project source files, assets, and metadata are retrieved via
canvas-source-retrieveas described in SKILL.md. - Boundary markers: The instructions do not define specific delimiters for separating project data from agent instructions, though they describe the project structure (
files,entryHtml,dependencies). - Capability inventory: The agent has capabilities to read and write files (
canvas-source-retrieve,canvas-edit-create), configure network access (capabilities.network.origins), and call external tools through connectors (capabilities.connectors). - Sanitization: The skill strongly mandates the use of
canvas-validate-createto detect and block unauthorized imports, dynamic scripts, and undeclared capabilities before any code is published or promoted. - [SAFE]: The skill is a set of defensive guidelines for a legitimate developer tool (PostHog). It includes specific restrictions against loopback, private IPs, and unauthorized third-party providers. The mention of base64 is for legitimate asset handling, and the instructions focus on preventing concurrent edit conflicts and ensuring build integrity.
Audit Metadata