The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it retrieves and processes untrusted data from the Canvas LMS environment.
Ingestion points: Data is ingested from student submissions, discussion topics, and wiki pages via tools like call_canvas_api_get (referenced in student_guide.md, teacher_guide.md, and submissions_and_grades.md).
Boundary markers: The instructions do not define boundary markers (e.g., XML tags or delimiters) or provide explicit warnings to the agent to ignore instructions embedded in the retrieved data.
Capability inventory: The skill allows for high-privilege operations, including modifying grades, sending messages (communication_and_groups.md), and managing system-level configurations (accounts_and_admin.md).
Sanitization: No evidence of data sanitization or validation of the fetched content is present in the skill's instructions.
[COMMAND_EXECUTION]: The skill requires running a shell command to initialize its execution environment.
Evidence: The setup section in SKILL.md instructs the agent to execute npm --silent --prefix canvas-lms-mcp start to connect to the MCP server.

canvas-lms