canvas-design
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill includes instructions in the 'FINAL STEP' section of SKILL.md that falsely claim the user has already provided specific negative feedback ('It isn't perfect enough'). This technique is a form of context manipulation designed to force the agent into a specific refinement behavior by overriding the actual conversation state.
- [EXTERNAL_DOWNLOADS]: The 'CANVAS CREATION' section in SKILL.md instructs the agent to 'Download and use whatever fonts are needed'. This is a broad instruction that encourages the ingestion of external resources from unverified sources at runtime, which increases the attack surface for malicious assets if the agent has network tools enabled.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied conceptual threads ('subtle conceptual thread') and has the capability to write multiple file types, creating a vulnerability surface for indirect injection.
- Ingestion points: User input provided during the 'DEDUCING THE SUBTLE REFERENCE' and art creation steps (SKILL.md).
- Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands within the user-provided conceptual data.
- Capability inventory: File system write access for .md, .pdf, and .png files (SKILL.md).
- Sanitization: None; the skill does not specify any validation or escaping of the user-provided conceptual input before processing.
Audit Metadata