The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates and installs JavaScript code into the tldraw document workspace via the /api/doc/:id/script-workspace endpoint. This code (in main.js, config.js, and widgets.js) is executed by the tldraw app to provide widget functionality.
[COMMAND_EXECUTION]: The scripts/new-canvas shell script uses the open command to launch the tldraw offline application on macOS.
[CREDENTIALS_UNSAFE]: The skill reads a local server.json file (typically in ~/Library/Application Support/tldraw/) to obtain an authentication token and port number required to communicate with the tldraw application's local API.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements to create widgets and suggests porting logic from external references (e.g., CodePen, D3), which could theoretically introduce malicious logic into the generated scripts, though it advises against direct copy-pasting.

canvas-widget