The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read, parse, and modify existing .canvas files. These files contain arbitrary user-controlled content in text and label fields, which serves as a vector for indirect prompt injection if an attacker embeds instructions intended to influence the agent's behavior during the parsing or editing process.
Ingestion points: SKILL.md (Common Workflows 2 and 4) specifies that the agent should "Read and parse the existing .canvas file" when adding nodes or editing the canvas.
Boundary markers: The instructions lack specific guidance or delimiters to distinguish between data content (node text) and instructions for the agent, increasing the risk that the agent may follow instructions embedded within the canvas data.
Capability inventory: The skill describes capabilities for reading from and writing to the local file system (specifically .canvas files in JSON format).
Sanitization: There is no mention of sanitizing or validating the text, label, or file fields to prevent path traversal or instruction injection.

json-canvas