canva
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes the official Canva domain (
mcp.canva.com) to facilitate Model Context Protocol (MCP) operations. This is an expected and safe communication channel for the service. - [SAFE]: Analysis of the instructions and metadata revealed no evidence of prompt injection, obfuscation, or persistence mechanisms.
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for design templates and brand assets. While this technically creates a surface for indirect prompt injection, it is the primary intended function of the design automation tool, and no specific unsafe interpolation or lack of sanitization was observed in the provided instructions.
Audit Metadata