The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell scripts (scripts/tq and scripts/new-canvas) designed to be run by the agent. These scripts perform local file operations (creating directories, copying templates) and interact with the local operating system (e.g., using open to launch the tldraw app on macOS).
[DYNAMIC_EXECUTION]: The bridge mechanism works by sending JavaScript code snippets to a local HTTP server provided by the tldraw offline application. This code is executed within the application to query and manipulate canvas shapes.
[CREDENTIALS_UNSAFE]: The scripts/tq utility reads a local configuration file (server.json) to extract an authentication token and port number. This token is used to authenticate the agent's local HTTP requests to the application's API. This is a standard local authentication flow for this integration.
[INDIRECT_PROMPT_INJECTION]: The skill ingests shape data and metadata from tldraw documents, which could theoretically contain adversarial instructions. However, the skill documentation includes best-practice advice to treat external content as untrusted and to avoid direct execution of fetched code.

canvas-theme