The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes methods for ingesting data from external sources, including GitHub via ph.connectors and PostHog system tables. This creates a potential surface where untrusted data containing instructions could be processed by the agent.
Ingestion points: Data enters the agent's context through ph.loadInsight, ph.query, and ph.connectors.call (e.g., repository metadata or task descriptions).
Boundary markers: The skill does not define specific string sanitization for external content, but recommends structured UI rendering.
Capability inventory: The bridge provides access to ph.actions.invoke (writes), ph.tools.call (MCP tools), and ph.agent.request (agent-driven changes).
Sanitization: The platform architecture mandates user-in-the-loop confirmation for all sensitive operations (actions, tools, agent requests), which effectively mitigates the risk of automated execution from injected instructions.
[DATA_EXFILTRATION]: The skill documents the ability for canvases to perform external network requests using fetch() to domains declared in the project's capabilities.
This functionality is protected by platform-level controls: all direct network access is blocked during the edit-mode preview, and all external origins must be explicitly allowlisted before a canvas is published.
[CREDENTIALS_SAFE]: The documentation includes explicit security best practices, warning developers that ph.state (durable storage) is team-visible and should never store secrets or PII. It also clarifies that credentials for the bridge stay in the host environment and are inaccessible to the sandboxed code.

querying-canvas-data