Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/markpasternak/canvas-drop/skillgit clone --depth 1 https://github.com/markpasternak/canvas-dropWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00733 |
| Opus 5 | $0.00000 | $0.00367 |
| Sonnet 5 | $0.00000 | $0.00147 |
| Haiku 4.5 | $0.00000 | $0.00073 |
Grade A, and why
skill scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fLOJ "{base}/skill.zip" How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent skill
Install this skill so your coding agent deploys and extends canvases against this
instance, first try, without manual correction. It ships in the standard skill
format (a SKILL.md with name/description frontmatter and a when-to-use
trigger), so an agent loads it automatically when a task matches.
Download and install
GET /skill.zip is public — no session or API key required — so an agent can fetch
and unpack it in one step:
curl -fLOJ "{base}/skill.zip"
unzip canvas-drop-skill.zip -d ~/.claude/skills/
Replace {base} with this instance's base URL. The download is named
canvas-drop-skill.zip and unpacks to a single canvas-drop/ folder containing
SKILL.md plus an optional examples/ directory. Point your agent at the unpacked
SKILL.md, or drop the folder wherever your agent discovers skills. The skill is
self-contained: it refers to this instance by base URL and asks the user for
{base} when it doesn't know it.
What's inside
The zip is built from an explicit allowlist (SKILL.md plus examples/*.md), so it
never carries a stray secret. The skill covers four ways to work against this
instance:
- Connect over MCP. Add
{base}/mcp, sign in once through the instance's own login, then call identity-scoped tools (whoami,list_canvases,create_canvas,deploy_canvas,get_canvas_file,rollback_canvas, the draft-editor loop, version export/deletion, and more — 44 tools in all) with no key to paste. See the MCP server. - Deploy over HTTP with a per-canvas API key:
PUT {base}/v1/canvases/{id}/deploy(Bearer auth, ZIP body) publishes immediately. Companion read-back and recovery routes (GET {base}/v1/canvases/{id},…/versions,…/files,POST …/rollback,POST …/unpublish) let an agent confirm what went live and undo it. See Deploy API. - Add backend capability with the zero-config browser SDK. One
<script src="/sdk/v1.js">tag defines the globalwindow.canvasdropand rides the signed-in session cookie, so the five primitives (KV, files,me(), AI, realtime) work with no keys in client code. See the SDK overview. - The golden rules. Never put a secret in canvas files. Canvases are static
only, with no server build step. Every primitive is off until the owner enables
Backend plus that feature, so a disabled call throws
CapabilityDisabledError(code: "CAPABILITY_DISABLED", status 403). - Typed errors. Branch on a stable
err.code/err.statusrather than parsing messages. Full table at Error codes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 56 lines · 0 tokens per session scan A 266214df55d4
skill is an agent published in the GitHub repository markpasternak/canvas-drop (7 stars, last pushed 19d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 733 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
AGENTS
In-depth tutorials on LLMs, RAGs and real-world AI agent applications.
deployment-specialist
Handles all deployment operations.
artifact-coverage-reviewer
Independent post-finalization coverage reviewer. Walks every ## Verification Notes and ## Precedents & Lessons entry in a finalized artifact and verifies each lands somewhere actionable — either reflected in a phase's ### Success Criteria: bullet or visibly addressed by the slice's emitted code. Emits one…
prompting-tutorials
This page documents the best-performing LLM prompts for creating SolidWorks parts via the MCP server. Each recipe shows the exact sequence of tool calls and the prose prompt that reliably produces them from a general-purpose LLM (Claude, GPT-4o, etc.).
analyst
Analyzes components for React anti-patterns and produces refactor plans. Use when starting a new refactor subtask.
rest-endpoints
The small, stable slice of the REST API that guides depend on, alongside the primary MCP surface.