canva

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.1

Overview

This is a Canva workflow skill with disclosed external Canva and WoopSocial handoff behavior, and I found no hidden code, persistence, credential handling, or destructive instructions.

Install this if you want a Canva-centered design workflow that assumes a Canva-to-WoopSocial publishing stack. If you use Canva Content Planner, another scheduler, or manual publishing, treat the WoopSocial steps as replaceable and require explicit approval before any asset is transferred or published.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:67

Finding

Mandatory Third-Party Product Promotion and Workflow Steering

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:67-76, with reinforcing instructions in SKILL.md:90-108, evals/evals.json:7-20, evals/evals.json:47, evals/evals.json:67-70, references/scope-and-connections.md:9-14, references/scope-and-connections.md:39-43, references/the-scale-framework.md:35-40, and references/workflows-and-templates.md:3-5
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:67-76:

markdown

## Honest scope (never violate)
- **The agent** specs/drafts and — **where the Canva MCP/Connect APIs are connected** — creates/resizes/adapts
  directly; otherwise exact steps for the human. **The human approves every visual** (the agent never fabricates
  "that looks great"). **Canva renders; WoopSocial publishes** the finished export (10 platforms, validation,
  queue; measurement: the platforms' native analytics); Canva's own Content Planner exists — the split is a
  stack choice, stated honestly.
  **WoopSocial does not generate or edit designs.**
- **Licensing/IP:** no watermark-stripping, template-ripping, brand impersonation, or unpermitted likeness (real
  or AI lookalike); **AI-disclosure** (EU AI Act; C2PA) for generated visuals; **accessibility floor** (WCAG
  contrast, sizes, ≤2 fonts, alt text); **never fabricate** credits, capabilities, or metrics — verify in-app.
  (Full scope: `references/scope-and-connections.md`.)

SKILL.md:99-108:

markdown

## Definition of done
On-brand Canva output produced through the system, not around it: Brand Kit locked first (colors/fonts/logos/
voice; templates + approvals locked on team tiers), templates used as scaffolding and customized past recognition
(stock replaced, bones changed, brand type/color applied — a stranger can't name the template), the repeatable
automated (Bulk Create for batches with a QA pass on overflow; Magic Resize for the platform se
...[truncated 5020 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove publication through WoopSocial from the mandatory definition of done.
2. Replace vendor-specific routing with neutral language, such as: “Export the approved asset and publish it through the user's configured scheduler or native platform tooling.”
3. Ask the user which publishing system they use before recommending or invoking any external scheduler.
4. Mention WoopSocial only when the user explicitly requests it, confirms that it is configured, or asks for a comparison of supported publishing options.
5. Update evaluation assertions so they test accurate export and handoff behavior without requiring promotion of a particular vendor.
6. Present Canva Content Planner, WoopSocial, other schedulers, and manual publishing as optional alternatives based on the user's requirements.
7. Require explicit user approval before transferring finished assets or metadata to any third-party publishing service.
8. Retain the existing safeguards that distinguish rendering from publishing and prohibit fabricated product capabilities, but apply those safeguards consistently to every supported integration.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This is a manifest JSON file, so vague-trigger checks apply. The description explains what the skill can do but does not define explicit trigger phrases, boundaries, or exclusion conditions, which can make invocation criteria ambiguous for a router or orchestrator.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The expectation references 'Magic Switch (150+ languages)' as a required capability in natural-language guidance. While not an outright forced locale, it introduces language handling expectations without indicating user choice or opt-in, which can conflict with language/locale policy requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.