The Agent Skills Directory

[COMMAND_EXECUTION]: Provides detailed command-line examples for interacting with the Acquia Source API using curl. This includes patterns for performing OAuth2 client-credentials authentication and making JSON:API requests to retrieve or modify CMS content.
[COMMAND_EXECUTION]: Instructs the agent on using the @drupal-canvas CLI through npx to scaffold codebases, download components, and upload them to the remote site. These operations involve executing local development tools that interface with the SaaS platform.
[EXTERNAL_DOWNLOADS]: Utilizes the @drupal-canvas/create package and related CLI tools via npx, which are fetched from the public npm registry at runtime. These tools are the official distribution method for the service's development workflow.
[CREDENTIALS_UNSAFE]: Explicitly instructs users to manage sensitive credentials (CANVAS_CLIENT_ID, CANVAS_CLIENT_SECRET) using a local .env file that should never be committed, adhering to industry-standard secret management practices.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an integration surface where the agent ingests data from a remote CMS (Acquia Source) via JSON:API and MCP protocols.
Ingestion points: Data is retrieved from site-specific endpoints (e.g., https://<uuid>.cms.acquia.site/api).
Boundary markers: The skill does not provide specific prompt boundary markers or instructions to treat the CMS content as untrusted.
Capability inventory: The agent is granted capabilities to read, write, and patch content, as well as execute local CLI tools to manage code components.
Sanitization: No explicit sanitization or validation of the content retrieved from the CMS is documented in the skill instructions.

acquia-source