The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to read, parse, and update existing .canvas files, which serves as a vector for indirect prompt injection if the files originate from untrusted sources.
Ingestion points: Workflows for adding nodes (Workflow 2) and editing canvases (Workflow 4) in SKILL.md involve reading and parsing existing .canvas files from the file system.
Boundary markers: The instructions lack specific boundary markers or warnings to the agent to disregard instructions that might be embedded within the text fields of the canvas JSON.
Capability inventory: The skill allows for writing modified JSON data back to files (Workflow 1 and 4), creating a potential write-back loop for injected content.
Sanitization: While the skill advises validating JSON structure and ID integrity, it does not specify sanitization or filtering for the markdown content in text nodes or the paths in file nodes.

json-canvas