The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several shell commands such as npx canvas, ls, cat, jq, and date. These are used for legitimate project tasks including template validation, directory listing, and checking the modification time of configuration files to ensure data freshness.
[EXTERNAL_DOWNLOADS]: The skill uses npx to run the canvas CLI. Depending on the environment configuration, npx may download the package from a public or private registry if it is not found locally. This is a common pattern in JavaScript development environments.
[DATA_EXPOSURE]: The instructions require the agent to read local project files, specifically JSON and YAML configurations located in .agents/drupal-canvas/ and src/components/. This file access is limited to the project scope and is necessary for the skill's primary function of mapping entity fields to components.
[INDIRECT_PROMPT_INJECTION]: The skill acts on data ingested from local JSON and YAML files. It lacks explicit instructions for sanitizing this input or using boundary markers. However, given the context of a developer tool operating on a local codebase, the risk of malicious instructions being embedded in these configuration files is low.

canvas-content-templates