Trust Assessment
canva-automation received a trust score of 94/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Potential Data Exfiltration via URL-based Asset Upload.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential Data Exfiltration via URL-based Asset Upload The `CANVA_CREATE_ASSET_UPLOAD_JOB` tool is described as accepting a `url` parameter for uploading assets from a public URL. If an attacker can manipulate the LLM (e.g., through prompt injection) to provide a malicious or sensitive internal URL, the agent could be instructed to upload data from that URL to Canva. This could lead to unintended data exfiltration from systems accessible to the agent. Implement strict validation and sanitization of the `url` parameter to ensure it points only to trusted sources or restrict its use to pre-approved domains. Consider adding a warning to the user before uploading from an external URL. If possible, prefer direct file uploads over URL-based uploads for sensitive data. | LLM | SKILL.md:78 |
Scan History
Embed Code
[](https://skillshield.io/report/efaaeafb16397e29)
Powered by SkillShield