canvas — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited canvas (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Using podium, act on the canvas/WebGL UI of the WebView app on simulator/device $ARGUMENTS (format: <UDID> <intent>, e.g. <UDID> close the popup). Parse the first whitespace token as the UDID; everything after it is the INTENT.
No screenshots, no vision — drive the live scene graph as DOM-like elements.
canvas_inspect with the UDID — confirm a framework was detected and list the addressable objects. If framework is unknown or count is 0, report the returned hint (expose the framework root on window, or fall back to a screenshot + tap_with_fallback) and stop.list or empty, present the objects as a markdown table (name / text / type / x,y) and stop.canvas_resolve with the UDID and the intent — show the ranked candidates with their reasons and the confidentEnough flag.confidentEnough is false, do NOT tap. Present the top candidates and ask the user which one (fail-closed by design — two equally-good targets must not be blind-tapped).confidentEnough is true, call canvas_tap with the UDID and the intent — then report what was tapped (name/text), the screen coordinates, and the backend used.Notes:
PODIUM_ALLOW_VISION=1).PODIUM_DISABLE_WEBVIEW_EVAL=1 (the tools refuse to inject the bridge).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.