The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell scripts (scripts/new-canvas and scripts/tq) to manage the local filesystem (mkdir, cp) and to communicate with the tldraw application's local server. These scripts execute system-level commands like open and curl to automate the desktop application.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to parse user-supplied prose into structured flowchart data, which is then used to generate JavaScript commands for the tldraw API. This creates a surface where maliciously crafted user input could attempt to influence the generated logic or local canvas state.
Ingestion points: User-provided text descriptions of processes, decision trees, or algorithms in the skill's primary input flow.
Boundary markers: The skill does not implement specific boundary markers or "ignore" instructions for the parsed user content before interpolation.
Capability inventory: The skill can create and open files on the local filesystem and execute arbitrary JavaScript in the context of a local tldraw document.
Sanitization: Input is parsed into a JSON model, but no further validation or sanitization of labels or logical flow is described.
[DYNAMIC_EXECUTION]: The skill dynamically constructs JavaScript code blocks based on user-provided steps and executes them via a local HTTP server to modify the state of the tldraw canvas at runtime.
[EXTERNAL_DOWNLOADS]: The documentation refers users to https://offline.tldraw.com for the official tldraw offline application and lists several well-known research and documentation sites (e.g., tldraw.dev, d3js.org). these references target established services and are provided for setup and development guidance.

flowchart