The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via user-provided system names used to construct file paths.
Ingestion points: The system parameter extracted from user input in SKILL.md (e.g., "customers can browse and order").
Boundary markers: The skill lacks delimiters or instructions to ignore embedded commands in the system name or file path.
Capability inventory: The skill can execute shell commands via scripts/new-canvas and scripts/tq, and run arbitrary JavaScript in the tldraw app via the /exec and /api/search endpoints.
Sanitization: The scripts/new-canvas script fails to sanitize the $TARGET variable for single quotes before interpolating it into a JavaScript code block: "filePath === '$TARGET'". This allows an attacker-controlled system name to inject and execute arbitrary code in the tldraw app's JavaScript environment.
[COMMAND_EXECUTION]: The skill executes local shell scripts (scripts/new-canvas, scripts/tq) and uses the host's open command to interact with the tldraw offline application. It also invokes python3 for processing JSON data.
[DYNAMIC_EXECUTION]: The skill generates and executes JavaScript code snippets at runtime to interact with the tldraw application's internal API.
[EXTERNAL_DOWNLOADS]: The references/shared/bridge.md file provides a link to https://offline.tldraw.com for users to download the necessary desktop application.

use-case-diagram