The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines an eval action that allows the execution of arbitrary JavaScript within the canvas of connected nodes (Mac, iOS, Android). This capability can be exploited to perform unauthorized actions on the user's devices if the agent is manipulated into executing malicious payloads.
[REMOTE_CODE_EXECUTION]: Through the present and navigate actions, the agent can be instructed to load external, attacker-controlled URLs on connected devices. Since the canvas environment supports JavaScript, this allows for remote code execution on the rendering node's WebView component.
[DATA_EXFILTRATION]: The snapshot action enables capturing screenshots of the canvas content. If combined with the eval action or malicious HTML content, this could be used to scrape sensitive information displayed in the canvas and provide it back to the agent or an external listener.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a high-risk attack surface for indirect prompt injection.
Ingestion points: The skill reads HTML, CSS, and JS files from the ~/clawd/canvas/ directory and accepts arbitrary URLs via the target and url parameters.
Boundary markers: There are no specified delimiters or instructions to ignore embedded commands within the processed HTML content.
Capability inventory: The skill includes eval (JavaScript execution), navigate/present (URL redirection), and snapshot (data capture) across the canvas system.
Sanitization: The documentation does not describe any validation or sanitization of the HTML content or JavaScript strings before they are sent to the connected nodes.

canvas