The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell scripts (scripts/new-canvas, scripts/tq) that perform file system operations such as mkdir and cp within the user's ~/canvas directory, and use open -a to control the local tldraw application.
[DYNAMIC_EXECUTION]: The skill generates JavaScript payloads at runtime to manipulate the tldraw canvas via a local bridge. A vulnerability was identified in scripts/new-canvas where the $TARGET shell variable is interpolated into a JavaScript string without escaping; a maliciously crafted filename could potentially break out of the string literal and execute arbitrary JavaScript within the tldraw application context.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as database schemas and DDL snippets.
Ingestion points: External data is ingested as prose or code snippets to be transformed into ER diagrams as described in SKILL.md.
Boundary markers: The skill does not employ specific delimiters or instructions to the agent to ignore potentially malicious instructions embedded in the input data.
Capability inventory: The skill has the ability to execute shell commands, perform local network requests, and execute JavaScript on the tldraw canvas via the bundled helper scripts.
Sanitization: While the workflow includes a parsing and normalization step, there is no explicit sanitization or validation to prevent embedded instructions from influencing the agent's behavior.
[EXTERNAL_DOWNLOADS]: The documentation refers to the official offline.tldraw.com domain for users to download the necessary desktop application, which is a well-known and trusted service.

er-diagram