canvas-theme
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell scripts (scripts/tq and scripts/new-canvas) to interact with the tldraw offline application. These scripts use standard tools like curl and open to manage canvas documents.
- [REMOTE_CODE_EXECUTION]: The skill sends JavaScript code snippets to the local tldraw server's /api/search and /exec endpoints. This is the intended mechanism for the agent to programmatically inspect and modify the canvas state.
- [CREDENTIALS_UNSAFE]: The skill reads a per-launch authentication token from a local file (server.json) to authenticate its requests to the local tldraw API. This is a standard security practice for local inter-process communication.
- [PROMPT_INJECTION]: The skill processes existing canvas data (shapes and metadata) which constitutes an indirect prompt injection surface. The workflow involves reading shape properties and applying style changes based on that data, which could be manipulated to influence the agent's behavior. (1) Ingestion points: SKILL.md (Workflow step 1: api.getShapes call); (2) Boundary markers: Absent; (3) Capability inventory: scripts/tq (local API communication), api.exec (JavaScript execution in tldraw app); (4) Sanitization: Absent.
Audit Metadata