The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute the @drupal-canvas/create scaffolding package via npx. It also recommends adding supplementary agent instructions from drupal-canvas/skills using the npx skills add command. These resources are specific to the tool's ecosystem and appear to be legitimate developer utilities associated with the framework.
[COMMAND_EXECUTION]: Provides shell commands for project initialization and skill management using npx. These commands are intended for environment setup and extending the agent's specialized knowledge for Drupal component development.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill defines components that interact with Drupal entities, fields, views, and APIs (referenced in SKILL.md under Component Structure and Data Fetching).
Boundary markers: The example component logic and metadata templates do not include explicit instructions or delimiters to isolate data fetched from Drupal from the agent's instructional context.
Capability inventory: The skill has the capability to execute shell commands (npx) and install additional agent logic, which increases the potential impact if a downstream injection occurs.
Sanitization: The skill relies on standard React/TypeScript prop patterns for data rendering but lacks specific guidance for the agent to sanitize or validate external content to prevent it from being interpreted as instructions.

drupal-canvas