The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates reading and parsing existing .canvas files which contain user-provided text. This represents a potential surface for indirect prompt injection if malicious instructions are embedded in the canvas content.
Ingestion points: The agent is instructed to read existing .canvas files (specifically the text attribute of nodes) in 'Common Workflow 2' and 'Common Workflow 4' in SKILL.md.
Boundary markers: The skill does not specify the use of delimiters or 'ignore' instructions for the text content within nodes.
Capability inventory: The skill involves file system operations to read, write, and modify .canvas files.
Sanitization: No explicit sanitization or validation of the Markdown text content is defined within the workflow.
[DATA_EXPOSURE]: The skill supports 'File Nodes' which can contain paths to files within the user's system (documented in SKILL.md and exemplified in references/EXAMPLES.md). While this is a core feature of the JSON Canvas specification for linking local assets, it is a mechanism by which local file paths are ingested into the agent's context.

json-canvas