canvas-design
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill uses a manipulative "fake history" injection in the "FINAL STEP" section. It instructs the agent to act as if the user has already stated "It isn't perfect enough. It must be pristine...", effectively overriding the actual conversation context to force a specific refinement behavior.
- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection by processing untrusted data.
- Ingestion points: The skill ingests user-supplied "subtle input or instructions" (referenced in SKILL.md) to serve as the conceptual DNA for the art.
- Boundary markers: There are no explicit delimiters or instructions to ignore potential commands embedded within the user's conceptual data.
- Capability inventory: The skill is authorized to write multiple file types (.md, .pdf, .png) and suggests the ability to download external resources.
- Sanitization: No validation or sanitization of the user-provided conceptual input is mentioned.
- [EXTERNAL_DOWNLOADS]: The instructions explicitly tell the agent to "Download and use whatever fonts are needed," which implies the execution of network operations to fetch external binaries from unspecified remote sources.
Audit Metadata