canvas-course-builder
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its core functionality of ingesting and processing untrusted data to perform bulk operations.
- Ingestion points: Untrusted data enters the agent context through natural language specifications, user-provided JSON template files (Mode 2), and data retrieved from existing Canvas courses via the
get_course_structuretool (Mode 3). - Boundary markers: The skill includes explicit boundary markers, requiring the agent to generate a "Course Build Plan" preview and wait for "explicit approval" from the user before execution. Additionally, items are created "unpublished by default" to mitigate immediate impact.
- Capability inventory: The skill possesses significant write capabilities, including
create_module,create_page,create_assignment,create_discussion_topic, andadd_module_itemfor bulk creation in the Canvas environment. - Sanitization: The instructions do not explicitly mandate sanitization or filtering of the content retrieved from templates or existing courses before using that content to populate new course items.
Audit Metadata