The Agent Skills Directory

[DYNAMIC_EXECUTION]: The eval action allows for the execution of arbitrary JavaScript within the WebView context of connected nodes, enabling runtime code execution on remote devices.
[DATA_EXFILTRATION]: The snapshot action provides the ability to capture screenshots of the active canvas on connected nodes, which could be misused for unauthorized surveillance or sensitive data collection.
[DATA_EXFILTRATION]: The skill instructions facilitate the collection of network and process metadata (e.g., via tailscale status, lsof), which could be exfiltrated to expose internal infrastructure details.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted HTML and JS content from the ~/clawd/canvas/ directory (SKILL.md). It lacks explicit boundary markers or content sanitization. Combined with its capability inventory (eval, snapshot, navigate, present from SKILL.md), this creates a surface where instructions embedded in processed data could manipulate agent behavior.
[PROMPT_INJECTION]: The skill relies on natural language safety guardrails to prevent phishing and risky network configurations. These instructions are susceptible to prompt injection attacks intended to bypass safety filters and coerce the agent into performing restricted actions.

canvas-hardened