Security audit

Canvas Json Handler

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a canvas JSON automation tool, but its broad activation wording, unclear API/network boundary, and file-mutating repair/rollback behavior need user review before installation.

Install only if you intend to let the agent read and write specific .canvas/JSON files and run local layout or processing commands. Before use, ask the agent to preview diffs, list affected files, avoid generic API integrations unless explicitly configured, and require confirmation before rollback, merge, aggressive repair, or deletion operations.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill documentation gives conflicting guidance about whether API keys are required, which can mislead operators into unsafe setup or troubleshooting behavior. In practice, contradictory security/operational instructions increase the chance that users expose credentials unnecessarily or enable networked functionality they did not intend to use.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document states the skill does not rely on external APIs, yet later describes API/network behavior, authentication failures, rate limits, and external service usage. This ambiguity obscures the true trust boundary of the skill and may cause users to permit outbound connectivity or sensitive data transmission under false assumptions.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill is presented as a canvas-JSON handling tool, but the documentation also advertises generic API integration capability unrelated to that narrow purpose. Scope creep of this kind is risky because it normalizes broader external interactions than users expect, increasing the chance of data exfiltration, unintended network access, or misuse of the exec/write toolset.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation description is extremely broad, saying to use the skill whenever efficiency, automation, or workflow optimization is needed. In an agent environment with read/exec/write tools, such vague triggering can cause the skill to activate in unrelated contexts and perform file or command operations beyond the user's intended scope.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill describes snapshot creation, version comparison, and one-click rollback but does not prominently warn that these actions modify user data or restore older state. In a file-writing skill, insufficient warning around rollback and state changes can lead to accidental overwrites or loss of recent work.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The automatic repair engine can reconstruct, alter, or delete references, including removal of dangling edges in aggressive mode, but the documentation does not foreground the destructive risk. Because the skill has write capability, users may trigger irreversible graph changes without understanding that repair can delete valid relationships or mutate identifiers.

Static analysis

No suspicious patterns detected.