The Agent Skills Directory

Indirect Prompt Injection (MEDIUM): The skill creates a significant attack surface by allowing the agent to perform write operations (create designs, upload assets, export files) based on untrusted external data.
Ingestion points: Untrusted data enters the skill via scripts/canva.sh arguments, specifically the autofill JSON payload and upload file paths.
Boundary markers: Absent. The skill does not use delimiters or instructions to prevent the agent from obeying commands embedded in design templates or asset names.
Capability inventory: The skill utilizes curl for network requests to api.canva.com, handles file uploads, and generates export URLs for designs.
Sanitization: Absent. User-provided data is interpolated directly into shell commands and JSON strings in scripts/canva.sh, which could lead to malformed requests or logic bypass.
Data Exposure & Credentials (LOW): The skill manages sensitive OAuth 2.0 credentials.
Evidence: scripts/canva-auth.sh stores access and refresh tokens in plain text at ~/.canva/tokens.json. While it correctly applies chmod 600 to restrict access, these tokens remain a high-value target for local data exposure.
Persistence (LOW): The documentation encourages users to modify sensitive shell configuration files.
Evidence: README.md suggests adding CANVA_CLIENT_ID and CANVA_CLIENT_SECRET to ~/.bashrc or ~/.zshrc for persistence, which is a standard configuration practice but involves modifying shell profiles.

canva