canvas-design
Verdict safe, but 2 findings (2 medium), mainly prompt injection, social engineering. Most recent scan 2026-02-07.
MODERATE RISK - This skill has a concerning transitive trust pattern where it may follow 'instructions by the user' rather than treating user input as design requirements. The missing manifest fields (allowed-tools, compatibility) reduce transparency about capabilities. The skill appears to be a creative design tool for generating visual art philosophies and artifacts, which is legitimate, but the instruction framing creates ambiguity about whether user input is data or commands. No active malicious code detected (no scripts present), but the instruction design pattern needs improvement. The truncated content and phantom file references suggest incomplete development or packaging issues.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
- Package
- 83 files, 5.3 MB
- SKILL.md
- 1693 words, 9 sections
- Code
- None. Instructions only.
- License
- Complete terms in LICENSE.txt
SKILL.md covers: DESIGN PHILOSOPHY CREATION · THE CRITICAL UNDERSTANDING · HOW TO GENERATE A VISUAL PHILOSOPHY · PHILOSOPHY EXAMPLES · ESSENTIAL PRINCIPLES · DEDUCING THE SUBTLE REFERENCE · CANVAS CREATION · FINAL STEP · MULTI-PAGE OPTION
Findings
MEDIUM Transitive Trust Abuse - Instruction Following from User Input Prompt Injectionllm
The skill instructions contain a critical misunderstanding of its role. The phrase 'What is received: Some subtle input or instructions by the user that should be taken into account' followed by 'The next phase involves making the artwork' suggests the skill may follow instructions embedded in user input rather than treating user input as data to be processed. This creates a transitive trust vulnerability where malicious instructions in user requests could be executed as commands rather than treated as content to design around.
SKILL.md
'What is received: Some subtle input or instructions by the user that should be taken into account, but used as a foundation; it should not constrain creative freedom.' and 'The next phase involves making the artwork' - This framing suggests following user instructions rather than treating them as design requirements.MEDIUM Incomplete Manifest - Missing Critical Security Fields Social Engineeringllm
The skill manifest is missing critical security-relevant fields: 'compatibility' and 'allowed-tools' are both 'Not specified'. While allowed-tools is optional per spec, its absence prevents users and systems from understanding what capabilities this skill requires. The skill creates .md, .pdf, and .png files, which implies Write tool usage at minimum, but this is not declared. Missing compatibility information prevents users from understanding execution environment requirements.
SKILL.md
compatibility: Not specified, allowed-tools: Not specified. Instructions state: 'Output only .md files, .pdf files, and .png files' which implies Write tool requirement.What is in the package
83 files, 5.3 MB. Show the list.
| File | Kind | Size |
|---|---|---|
LICENSE.txt | doc | 11 KB |
SKILL.md | doc | 12 KB |
canvas-fonts/ArsenalSC-OFL.txt | doc | 4.3 KB |
canvas-fonts/ArsenalSC-Regular.ttf | binary | 162 KB |
canvas-fonts/BigShoulders-Bold.ttf | binary | 92 KB |
canvas-fonts/BigShoulders-OFL.txt | doc | 4.3 KB |
canvas-fonts/BigShoulders-Regular.ttf | binary | 92 KB |
canvas-fonts/Boldonse-OFL.txt | doc | 4.3 KB |
canvas-fonts/Boldonse-Regular.ttf | binary | 75 KB |
canvas-fonts/BricolageGrotesque-Bold.ttf | binary | 89 KB |
canvas-fonts/BricolageGrotesque-OFL.txt | doc | 4.3 KB |
canvas-fonts/BricolageGrotesque-Regular.ttf | binary | 89 KB |
canvas-fonts/CrimsonPro-Bold.ttf | binary | 105 KB |
canvas-fonts/CrimsonPro-Italic.ttf | binary | 106 KB |
canvas-fonts/CrimsonPro-OFL.txt | doc | 4.3 KB |
canvas-fonts/CrimsonPro-Regular.ttf | binary | 104 KB |
canvas-fonts/DMMono-OFL.txt | doc | 4.3 KB |
canvas-fonts/DMMono-Regular.ttf | binary | 48 KB |
canvas-fonts/EricaOne-OFL.txt | doc | 4.3 KB |
canvas-fonts/EricaOne-Regular.ttf | binary | 24 KB |
canvas-fonts/GeistMono-Bold.ttf | binary | 76 KB |
canvas-fonts/GeistMono-OFL.txt | doc | 4.3 KB |
canvas-fonts/GeistMono-Regular.ttf | binary | 76 KB |
canvas-fonts/Gloock-OFL.txt | doc | 4.3 KB |
canvas-fonts/Gloock-Regular.ttf | binary | 93 KB |
canvas-fonts/IBMPlexMono-Bold.ttf | binary | 133 KB |
canvas-fonts/IBMPlexMono-OFL.txt | doc | 4.3 KB |
canvas-fonts/IBMPlexMono-Regular.ttf | binary | 131 KB |
canvas-fonts/IBMPlexSerif-Bold.ttf | binary | 157 KB |
canvas-fonts/IBMPlexSerif-BoldItalic.ttf | binary | 166 KB |
canvas-fonts/IBMPlexSerif-Italic.ttf | binary | 166 KB |
canvas-fonts/IBMPlexSerif-Regular.ttf | binary | 157 KB |
canvas-fonts/InstrumentSans-Bold.ttf | binary | 66 KB |
canvas-fonts/InstrumentSans-BoldItalic.ttf | binary | 68 KB |
canvas-fonts/InstrumentSans-Italic.ttf | binary | 68 KB |
canvas-fonts/InstrumentSans-OFL.txt | doc | 4.3 KB |
canvas-fonts/InstrumentSans-Regular.ttf | binary | 66 KB |
canvas-fonts/InstrumentSerif-Italic.ttf | binary | 69 KB |
canvas-fonts/InstrumentSerif-Regular.ttf | binary | 68 KB |
canvas-fonts/Italiana-OFL.txt | doc | 4.3 KB |
canvas-fonts/Italiana-Regular.ttf | binary | 27 KB |
canvas-fonts/JetBrainsMono-Bold.ttf | binary | 112 KB |
canvas-fonts/JetBrainsMono-OFL.txt | doc | 4.3 KB |
canvas-fonts/JetBrainsMono-Regular.ttf | binary | 112 KB |
canvas-fonts/Jura-Light.ttf | binary | 151 KB |
canvas-fonts/Jura-Medium.ttf | binary | 151 KB |
canvas-fonts/Jura-OFL.txt | doc | 4.3 KB |
canvas-fonts/LibreBaskerville-OFL.txt | doc | 4.3 KB |
canvas-fonts/LibreBaskerville-Regular.ttf | binary | 144 KB |
canvas-fonts/Lora-Bold.ttf | binary | 131 KB |
canvas-fonts/Lora-BoldItalic.ttf | binary | 137 KB |
canvas-fonts/Lora-Italic.ttf | binary | 136 KB |
canvas-fonts/Lora-OFL.txt | doc | 4.3 KB |
canvas-fonts/Lora-Regular.ttf | binary | 131 KB |
canvas-fonts/NationalPark-Bold.ttf | binary | 77 KB |
canvas-fonts/NationalPark-OFL.txt | doc | 4.3 KB |
canvas-fonts/NationalPark-Regular.ttf | binary | 75 KB |
canvas-fonts/NothingYouCouldDo-OFL.txt | doc | 4.3 KB |
canvas-fonts/NothingYouCouldDo-Regular.ttf | binary | 31 KB |
canvas-fonts/Outfit-Bold.ttf | binary | 54 KB |
canvas-fonts/Outfit-OFL.txt | doc | 4.3 KB |
canvas-fonts/Outfit-Regular.ttf | binary | 54 KB |
canvas-fonts/PixelifySans-Medium.ttf | binary | 50 KB |
canvas-fonts/PixelifySans-OFL.txt | doc | 4.3 KB |
canvas-fonts/PoiretOne-OFL.txt | doc | 4.3 KB |
canvas-fonts/PoiretOne-Regular.ttf | binary | 44 KB |
canvas-fonts/RedHatMono-Bold.ttf | binary | 34 KB |
canvas-fonts/RedHatMono-OFL.txt | doc | 4.3 KB |
canvas-fonts/RedHatMono-Regular.ttf | binary | 34 KB |
canvas-fonts/Silkscreen-OFL.txt | doc | 4.3 KB |
canvas-fonts/Silkscreen-Regular.ttf | binary | 31 KB |
canvas-fonts/SmoochSans-Medium.ttf | binary | 58 KB |
canvas-fonts/SmoochSans-OFL.txt | doc | 4.3 KB |
canvas-fonts/Tektur-Medium.ttf | binary | 74 KB |
canvas-fonts/Tektur-OFL.txt | doc | 4.3 KB |
canvas-fonts/Tektur-Regular.ttf | binary | 74 KB |
canvas-fonts/WorkSans-Bold.ttf | binary | 187 KB |
canvas-fonts/WorkSans-BoldItalic.ttf | binary | 172 KB |
canvas-fonts/WorkSans-Italic.ttf | binary | 170 KB |
canvas-fonts/WorkSans-OFL.txt | doc | 4.3 KB |
canvas-fonts/WorkSans-Regular.ttf | binary | 184 KB |
canvas-fonts/YoungSerif-OFL.txt | doc | 4.3 KB |
canvas-fonts/YoungSerif-Regular.ttf | binary | 103 KB |
External hosts referenced
openfontlicense.org github.com www.apache.org www.github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit 69c0b1a06741. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Scan history
| Date | Verdict | Findings | Change | Analyzers | Raw |
|---|---|---|---|---|---|
| SAFE | 2 | = | static llm meta | JSON | |
| SAFE | 2 | first scan | static behavioral llm trigger meta | JSON |
Sources
- Repository: https://github.com/anthropics/skills/tree/main/skills/canvas-design
- Raw scan result: skills-canvas-design-scan.json
- Badge for your README:
- Request a re-scan