lean-ux-canvas
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of Markdown instructions, templates, and examples. It does not include any scripts, executables, or configuration that grants the agent access to sensitive tools or system resources. All referenced components (e.g., workshop-facilitation) are local to the repository.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted user data, such as product briefs or research summaries, to help populate the canvas. While this is an attack surface, the risk is negligible because the skill lacks capabilities like shell execution, file system modification, or network requests.
- Ingestion points: Step 0 (Gather Context) in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: Text generation only.
- Sanitization: Absent.
- [EXTERNAL_DOWNLOADS]: The documentation contains links to the official Lean UX Canvas blog and a PDF template (hosted on squarespace). These are standard informational references and do not involve automated code downloads or execution.
Audit Metadata