The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the workspace canvas (e.g., text labels and sticky notes) which could contain instructions intended to influence the agent. While the skill lacks explicit boundary markers or sanitization for this content, its capabilities are strictly limited to canvas layout manipulation, and the ingestion is required for the tool's primary purpose.
[DATA_EXFILTRATION]: The get_canvas_state tool exposes the local file paths of images and videos stored within the .canvas/assets/ directory. This reveals the location of project assets but does not expose sensitive system credentials or private keys.

canvas