The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions to bypass user confirmation and operate autonomously.
Evidence: 'Do not stop between checkpoints for routine permission requests.'
Evidence: 'Do not pause after "plan" to ask routine permission.'
Evidence: 'Ask only when truly blocked by missing credentials/secrets or irreversible production risk.'
These instructions explicitly override the agent's default behavior of requesting user permission before executing tools, which reduces human-in-the-loop oversight.
[COMMAND_EXECUTION]: The skill instructs the agent to perform autonomous git operations.
Evidence: 'When working in a git repo and the user asks to ship: After each verified checkpoint, stage and commit... Push after the final verification pass.'
Combining autonomous tool execution with automated code pushing increases the risk of deploying unauthorized or unreviewed changes to a repository.
[INDIRECT_PROMPT_INJECTION]: The workflow involves reading and processing external data (canvas descriptions) which can be influenced by untrusted content.
Ingestion points: The skill uses excalidraw describe (mentioned in sections 3 and 4 of SKILL.md) to read state from the canvas.
Boundary markers (absent): There are no instructions to the agent to distinguish between its own previous state and potentially malicious content embedded in elements on the canvas.
Capability inventory: The skill utilizes excalidraw (create, update, distribute, export, screenshot, viewport) and git (add, commit, push) commands.
Sanitization (absent): The output of excalidraw describe is consumed directly to influence subsequent agent actions without filtering or validation.

excalidraw-workflow