canvas
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Canvas API which could contain instructions intended to influence the agent.
- Ingestion points: Assignment descriptions and course metadata fetched in
scripts/canvas_api.py. - Boundary markers: Output is structured as JSON before being passed to the agent context.
- Capability inventory: The skill has no file-write or shell-execution capabilities.
- Sanitization: Assignment descriptions are truncated to 500 characters.
- [EXTERNAL_DOWNLOADS]: The skill relies on the
requestslibrary. - Source: Standard PyPI package registry.
- Execution method: Imported and used within the Python CLI script.
Audit Metadata