The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the @canva/cli tool to perform API operations. These commands are restricted to Canva-specific workflows like managing designs and assets.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to install the @canva/cli package via npm. This is an official package from the vendor and is used for its intended purpose of providing the CLI tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from API responses. It mitigates potential risks by instructing the agent to parse specific JSON fields such as data and error rather than outputting raw, unvalidated responses.
Ingestion points: API responses received via canva api commands.
Boundary markers: Instructions direct the agent to check the ok status and specific data structures.
Capability inventory: File read (via --body @file.json), network operations (via API calls), and package installation.
Sanitization: The agent is instructed to summarize results and useful IDs rather than providing raw response data.
[CREDENTIALS_UNSAFE]: The instructions explicitly prohibit the agent from accessing, printing, or copying authentication tokens or credentials, maintaining a high standard for secret handling and preventing accidental credential leakage.

canva-cli