The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the @useclawlink/cli tool from the NPM registry. This is the intended method for accessing the vendor's integration capabilities.
[COMMAND_EXECUTION]: The skill operates by executing shell commands (via npx @useclawlink/cli) to interact with the Canva API through a proxy service.
[CREDENTIALS_UNSAFE]: The documentation specifies that authentication credentials for the service are stored at ~/.clawlink/credentials.json. This is a sensitive file path containing active session keys.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it retrieves and processes content from an external platform (Canva).
Ingestion points: The skill retrieves design metadata, asset information, and user details through actions like canva_fetch_design_metadata_and_access_information (defined in SKILL.md).
Boundary markers: The instructions do not define specific delimiters or "ignore" rules for data ingested from the Canva platform.
Capability inventory: The agent can create assets, import designs, resize content, and manage export jobs using shell-based CLI commands (SKILL.md).
Sanitization: There is no explicit validation or sanitization process mentioned for the data fetched from external Canva designs before it is presented to the agent's context.

canva