The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it operates on external data (canvas source code) that is ingested into the agent's context and then used to drive subsequent editing and publishing actions. Instructions embedded within a canvas source file could potentially influence the agent's logic during the implementation loop.
Ingestion points: The canvas-source-retrieve tool is used to fetch existing source code in the 'Iteration loop' section of SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to treat the retrieved source code as untrusted data.
Capability inventory: The agent has capabilities to write and update data via canvas-edit-create, canvas-publish-create, and posthog:media-image-upload-start.
Sanitization: There are no instructions for sanitizing or validating the retrieved source code before it is processed or used in prompt interpolation.
[COMMAND_EXECUTION]: The skill facilitates the creation of interactive applications that can execute platform-level actions and tool calls.
The ph.tools.call and ph.actions.invoke APIs allow the generated canvas to perform operations within the PostHog environment. While the skill notes these require explicit user gestures and viewer confirmation, they represent a mechanism for executing code-driven tasks.
The ph.agent.request(prompt) feature allows the canvas application to programmatically request changes from the authoring agent, creating a direct loop where untrusted UI input could influence agent actions.

building-canvases