The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructions direct the agent to access files located in ~/.cursor/, specifically ~/.cursor/skills-cursor/canvas/SKILL.md and SDK definitions in ~/.cursor/skills-cursor/canvas/sdk/. These paths are sensitive as they reside within the user's home directory and contain application configuration and metadata.
[COMMAND_EXECUTION]: The skill instructions specify the use of the gh pr diff command to fetch data from GitHub. This involves executing an external process and performing network operations based on user-supplied PR identifiers.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a potential injection vector.
Ingestion points: Untrusted data is ingested from GitHub PR diffs (via gh) and chat transcript files (processed by scripts/cursor_canvas_adapters.py).
Boundary markers: The skill generates Markdown and HTML artifacts based on these inputs but does not consistently apply explicit boundary markers or warnings to prevent downstream agents from executing instructions embedded in the diffs or transcripts.
Capability inventory: The skill utilizes command execution (gh in SKILL.md) and file system writes (path.write_text in scripts/cursor_canvas_adapters.py) to the .artifacts/ directory.
Sanitization: The scripts/cursor_canvas_adapters.py file contains an _redact_preference_text function that uses regular expressions to detect and redact potential secrets (API keys, access tokens, passwords) and private identifiers (paths, emails) before including them in generated artifacts. It also includes URL validation via _safe_href to ensure links use safe protocols.

cursor-pr-review-canvas-pr-review-canvas