The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell scripts (scripts/new-canvas and scripts/tq) to automate tasks. These scripts perform filesystem operations such as creating directories and copying templates, and use curl and python3 to interact with the tldraw application's local API.
[DYNAMIC_EXECUTION]: According to the bridge.md documentation, the skill is capable of writing JavaScript to a document's script/ directory. These scripts are then loaded and executed by the tldraw application to provide durable behavior, custom tools, and interactive canvas widgets.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to parse and act upon potentially untrusted user data in the form of system descriptions or component lists. • Ingestion points: The skill parses user-provided prose or lists as defined in the Workflow section of SKILL.md. • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are implemented. • Capability inventory: The skill has the ability to execute shell commands and trigger JavaScript execution within the tldraw renderer process via API calls. • Sanitization: There is no evidence of input validation or sanitization to prevent malicious instructions within user prose from influencing the agent's actions or the generated canvas scripts.

architecture-diagram