qt-canvas2d

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies a data ingestion surface where the agent is expected to process user-provided source files, SVG path strings, and QML property values, which could potentially contain malicious embedded instructions.
  • Ingestion points: SKILL.md specifies that the agent will be "writing, reviewing, fixing, optimizing, or porting" source code and interpreting SVG data provided by the user.
  • Boundary markers: The skill includes a dedicated "Guardrails" section in SKILL.md that explicitly instructs the agent to treat all source materials as technical only and never as instructions.
  • Capability inventory: The skill enables the agent to generate and modify complex GPU-accelerated drawing code using QML and JavaScript.
  • Sanitization: The skill relies on the agent's adherence to natural language guardrail instructions to ensure that any commands embedded in user-provided data are ignored.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 03:59 PM