present
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates and installs JavaScript 'document scripts' (such as
main.jsandconfig.js) from local templates into the tldraw document workspace. These scripts enable persistent behaviors like keyboard-based slide navigation and custom sidebar overlays within the application. - [COMMAND_EXECUTION]: The skill utilizes shell scripts (
scripts/tqandscripts/new-canvas) to interact with the tldraw application's local API onlocalhost. These scripts manage document creation and execution of commands within the canvas environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied topics and outlines to create slide content. This ingestion of external data into the canvas environment represents a potential attack surface, which is managed through the application's built-in sandboxing and the use of kit-standard templates.
Audit Metadata