The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation provides implementation examples where user-controlled input, such as asset names and tags, is directly interpolated into shell commands as arguments (e.g., python ... --name "Custom Name"). This creates a surface for command injection if the agent fails to properly escape or sanitize these values before execution.
[DATA_EXFILTRATION]: The skill includes functionality to upload assets from external URLs (upload_from_url.py, batch_url_upload.py). This allows the agent to fetch data from arbitrary network locations and transmit it to Canva, which could be misused for unauthorized data movement or Server-Side Request Forgery (SSRF).
[PROMPT_INJECTION]: The skill processes untrusted data from local files and remote URLs, making it vulnerable to indirect prompt injection.
Ingestion points: Media files residing in the input/ directory and content fetched from arbitrary remote URLs.
Boundary markers: Absent. The skill instructions do not define delimiters or provide warnings for the agent to ignore potential instructions embedded within the processed assets.
Capability inventory: The skill has access to the Bash tool for shell execution, as well as Read and Write tools for file system interaction.
Sanitization: Absent. There is no mention of content validation, filtering, or escaping of metadata or data extracted from external sources before it is processed.

canva-asset-manager