canva-translate-design
Pass
Audited by Gen Agent Trust Hub on Feb 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection (LOW): The skill ingests untrusted text content from user-provided Canva designs which could contain malicious instructions aimed at manipulating the agent's behavior during the translation process. Evidence Chain: 1. Ingestion points: Text elements are retrieved via
Canva:start-editing-transaction(Step 3). 2. Boundary markers: None present in the workflow to isolate design text from instructions. 3. Capability inventory: The skill has write access to the user's Canva account viaCanva:perform-editing-operationsandCanva:commit-editing-transaction. 4. Sanitization: None identified; the skill relies directly on the LLM's translation capabilities to process the data.
Audit Metadata