The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/check-lib.mjs contains a runNode function that uses spawnSync to execute other Node.js scripts during self-testing and architectural validation workflows.
[DYNAMIC_EXECUTION]: The importPackage function in scripts/check-lib.mjs utilizes the dynamic import() statement to load packages from file paths computed at runtime, facilitating the use of pinned tooling.
[INDIRECT_PROMPT_INJECTION]: The skill defines an ingestion surface for untrusted user input via canvas touch gestures (taps, swipes, drags).
Ingestion points: Raw touch events enter the agent context through the useCanvasGestures hook in src/canvas/gestures/use-canvas-gestures.ts.
Boundary markers: Events are translated into a strictly typed CanvasIntent object, providing clear delimiters between user input and system instructions.
Capability inventory: Processing logic is restricted to pure intentToAction functions (e.g., src/features/tasks/canvas/intent-to-action.ts) that are prohibited from performing network operations or accessing sensitive state directly.
Sanitization: Inputs are validated against a shared CanvasLayout using a hitTest mechanism to ensure they map only to legitimate UI regions and domain actions.

canvas-gestures-and-hit-testing