canvas-table-integration
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the agent with instructions to install the
@qfei-design/canvas-tablepackage using standard package managers (pnpm, yarn, npm) if the library is missing from the environment. These commands are part of a documented pre-flight check to ensure the development environment is correctly configured. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external data, such as Make schema definitions and backend record values, which represents a potential surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent's context through runtime schema loading (
SKILL.md) and raw backend value normalization logic (references/make-field-display-patterns.md). - Boundary markers: The instructions mandate strict conversion of metadata into structured
IColumnobjects and the use of pure display adapters to isolate processing logic from raw inputs. - Capability inventory: The skill facilitates the generation of UI integration code, data update operations, and environment setup via package managers.
- Sanitization: The documentation requires detailed value normalization, including finite-number checks and specific handling for identity (user/department) and attachment fields, to ensure malformed data does not compromise the application.
Audit Metadata