The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The toolkit includes a script scripts/vendor-lucide.mjs that uses the system package manager to install the lucide-react package into a temporary directory for icon data extraction. The version string provided to the script is strictly validated against a semantic versioning regular expression to prevent command injection.
[EXTERNAL_DOWNLOADS]: Development and testing dependencies include @microsoft/vally, which are well-known packages from a established technology provider.
[COMMAND_EXECUTION]: The toolkit provides several utility scripts (scripts/new-canvas.mjs, scripts/sync-kit.mjs) and a PowerShell installer (scripts/install-local.ps1) that perform standard file system operations such as mirroring directories, creating folders, and writing boilerplate code files to scaffold new extensions.
[SAFE]: The skill includes a dedicated networking module kit/net.mjs that implements a server-side SSRF guard. This guard validates hostnames and IP addresses to prevent the agent from accessing loopback, private, or cloud metadata ranges.
[SAFE]: The kit implements a dependency-free JSON schema validator in kit/validate.mjs that is used to enforce input and state contracts. The validator explicitly uses Object.hasOwn checks to prevent prototype pollution and bypass attempts using inherited property names.

create-canvas-app