canvas
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill defines a structured data format for diagrams and provides usage examples. It does not contain scripts, binaries, or automated tasks.
- [SAFE]: No malicious patterns, obfuscation, or dangerous command execution were found. The inclusion of 'file' and 'link' node types is consistent with the established JSON Canvas specification for visual mapping.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an output format for displaying user-provided or agent-processed data, which creates a potential surface for indirect injection. However, the risk is evaluated as safe because the skill is restricted to visualization and does not provide tools for code execution or exfiltration.
- Ingestion points: Data used to populate 'text', 'label', 'file', and 'url' attributes in the canvas JSON structure.
- Boundary markers: The ```canvas markdown fence provides a structural boundary for the diagram content.
- Capability inventory: Visualization of text, local file paths, and external links.
- Sanitization: The skill does not define specific sanitization, relying on the host application's implementation of the Canvas renderer.
Audit Metadata