canvas-capture-extension
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
rebuild-extension.shexecutesbun run makewithin the directory specified by the--repoargument or an auto-detected path. This allows for arbitrary code execution if the agent is directed to process a malicious repository. - [DATA_EXFILTRATION]: Both
SKILL.mdandscripts/rebuild-extension.shcontain hardcoded absolute paths pointing to a specific user's home directory (/Users/jonathanburger/...). This exposes local environment details and user identity information within the skill instructions. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external repository paths provided by the agent or user, which are then used to trigger command execution.
- Ingestion points: The
--repo,--install-dir, and--browser-executablearguments inrebuild-extension.sh(referenced inSKILL.md). - Boundary markers: Absent. There are no instructions to verify the source of the repository before building.
- Capability inventory: The skill performs file system modifications (
mkdir -p,cp -R) and invokes a build tool (bun run). - Sanitization: The script performs basic existence checks for
package.jsonbut does not validate the content or safety of the build instructions within that package.
Audit Metadata