The Agent Skills Directory

[PROMPT_INJECTION]: The FINAL STEP section uses a simulated conversation history pattern ("The user ALREADY said...") to override the model's current state and force a specific 'masterpiece' persona and quality level.
[EXTERNAL_DOWNLOADS]: The CANVAS CREATION section instructs the agent to "Download and use whatever fonts are needed," which encourages fetching external assets from arbitrary remote sources without domain restrictions or integrity checks.
[DATA_EXFILTRATION]: The skill exhibits an attack surface for indirect prompt injection by ingesting untrusted user input to derive 'subtle references' and 'design philosophies' which are then used as high-level instructions for subsequent file generation and code execution steps.
Ingestion points: User-provided requests processed during the 'Design Philosophy Creation' and 'Deducing the Subtle Reference' phases.
Boundary markers: Absent; the instructions do not specify delimiters to separate user data from the generated philosophy instructions.
Capability inventory: File system writes (.md, .pdf, .png), network access for font downloads, and potential shell/code execution for canvas rendering.
Sanitization: No validation or sanitization is mentioned for the conceptual threads deduced from user input.

canvas-design