The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external, potentially untrusted sources which could contain malicious instructions.
Ingestion points: Reads external 'rails' via the helix rails command and processes user-generated notes, comments, and event deltas via helix canvas wait and API calls.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' markers when processing external data.
Capability inventory: The skill has access to Bash and PowerShell for tool execution, curl for local network requests, and implicit file read/write capabilities for managing artifacts.
Sanitization: There are no explicit requirements or steps provided for sanitizing or validating the content read from the canvas or rails before it is integrated into the agent's context.
[DYNAMIC_EXECUTION]: The skill generates interactive UI components that involve dynamic code execution.
HTML Cards: Supports html cards which render a sandboxed iframe with scripts allowed.
Prototype Cards: Supports prototype cards that use JSX modules (React) and allow users to tune values that are then processed by the agent.
[COMMAND_EXECUTION]: The skill provides instructions for managing local system processes.
Process Management: Recommends terminating server processes using a shell pipeline: kill "$(sed -n 's/.*"pid": *$[0-9]*$.*/\1/p' ~/.helix/canvas/<project>/<slug>/server.json)". This relies on the integrity of a locally stored JSON file containing process IDs.
[DATA_EXFILTRATION]: The skill accesses sensitive user data for diagnostic purposes.
File Access: Instructs the agent to read user-uploaded screenshots and attachments from ~/.helix/canvas/<project>/<slug>/uploads/ using file reading tools to assist in debugging and collaboration.

canvas