The Agent Skills Directory

[SAFE]: The skill is designed for visual data management and file manipulation within a specific, well-defined JSON schema.
[INDIRECT_PROMPT_INJECTION]: The skill processes external .canvas files which could theoretically contain malicious instructions in text fields.
Ingestion points: The skill reads and parses .canvas files from the filesystem (SKILL.md, Common Workflows).
Boundary markers: No specific boundary markers or instructions to disregard embedded content are provided for the text fields within the JSON structure.
Capability inventory: The skill uses file-read and file-write operations to manage canvas data.
Sanitization: While the skill mandates JSON structure validation and ID uniqueness, it does not include content-level sanitization for Markdown text nodes. However, this is an inherent characteristic of data-processing skills and does not represent a malicious instruction.

json-canvas