The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell scripts (scripts/new-canvas and scripts/tq) to manage document creation and to communicate with the tldraw offline application. The tq utility extracts a local session token and port from the application's server.json file to authenticate requests sent to localhost.
[DYNAMIC_EXECUTION]: The skill is designed to generate and execute JavaScript code within the tldraw document's script workspace (main.js and config.js). This allows the agent to implement custom logic and interactive elements on the canvas as part of the whitepaper creation process.
[INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface for indirect prompt injection because it reads and processes external data from the user's repository to generate content for the whitepaper.
Ingestion points: Source code files and documentation retrieved from the repository as part of the 'Gather material' workflow step in SKILL.md.
Boundary markers: The instructions do not define specific markers to delimit untrusted data from the agent's instructions.
Capability inventory: The skill has the ability to execute shell scripts and interact with the local application API.
Sanitization: No sanitization or validation of the ingested source material is specified before it is interpolated into the canvas output.

whitepaper