Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Niall-Young/Canvasight --skill canvasight-graph-writergit clone --depth 1 https://github.com/Niall-Young/CanvasightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/niall-young/canvasight/canvasight-graph-writer)<a href="https://agentmods.dev/skills/niall-young/canvasight/canvasight-graph-writer"><img src="https://agentmods.dev/badge/skills/niall-young/canvasight/canvasight-graph-writer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/niall-young/canvasight/canvasight-graph-writer"><img src="https://agentmods.dev/badge/skills/niall-young/canvasight/canvasight-graph-writer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00156 | $0.03426 |
| Opus 5 | $0.00078 | $0.01713 |
| Sonnet 5 | $0.00031 | $0.00685 |
| Haiku 4.5 | $0.00016 | $0.00343 |
Grade A, and why
canvasight-graph-writer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Canvasight Graph Writer
Translate user intent into a structured Canvasight graph. Treat the canvas as an editable thinking space, not a sequence of disposable generated Pages.
Required workflow
- If an active Canvasight project may exist or the user refers to current content, call
get_canvasight_graph_contextbefore classification. Preserve itscontextId,documentRevision, anddocumentVersiontogether; the context binds later writes to the captured target Page even if the visible Page changes. Use its node IDs, relationships, positions, andpreferences.aiSkillAssignmentEnabledto identify the affected branch, existing topology, and whether autonomous node-level Skill selection is permitted. - Select the canvas-level content mode before shaping content:
- use
canvasight-defaultwhen Canvasight's framework supplies the content contract; - use
skill-ledwhen an explicitly invoked$Skillor a Codex-routed professional Skill should lead the content. Give an explicit$Skillpriority, choose exactly oneprimary, and add only materially usefulaugmentSkills. Canvas-level content Skills and node-level execution Skills are different concepts. Read quality/skill-composition.md whenever either is present. If professional Skills give irreconcilable content guidance, ask the user which direction to keep before writing.
- use
- Classify four independent dimensions:
- one
intent:create,analyze,organize,refine,decide, orexecute; - one primary
domain:software-product,ux-design,codebase,article,research, ortask-execution; - one
maturity:explore,define,decide, ordeliver; - one
output:exploration-map,structured-outline,system-map,decision-map, orexecution-plan. Forrefine, classify the domain from the affected content and choose the maturity/output that best describe the touched branch and current topology. Do not pretend the Page has persisted framework metadata.
- one
- Always read quality/validation-repair.md and quality/graph-writing.md. Read task-body-markdown.md whenever the write creates or updates a Task body. Read node-types.md whenever the write creates, updates, groups, ungroups, promotes, or reuses an Asset Node or Group. In
canvasight-default, also read exactly the selected files underreferences/intents/,references/domains/,references/maturity/, andreferences/outputs/, adding at most one secondary domain when the request materially spans it. Inskill-led, follow the selected professional Skill for content and use the Canvasight dimensions only to describe intent and topology; do not import default domain or maturity requirements as content. - Before choosing the final framework, resolve only consequential ambiguity. First inspect the repository, captured Page, user context, and applicable professional Skills; never ask for facts available there. Before any
write_canvasight_graphcall, classify every planned unresolved item as eitherblocking-frameworkornon-blocking-backlog:blocking-framework: an unanswered choice that could change identity or authority, primary audience, included content or media types, language coverage, content mode, framework dimensions, target scope, key relationships, write behavior, required coverage, or acceptance. If the planned visible output would describe it as “待确认”, “待定”,TBD,open question,unknown, or equivalent, callask_canvasight_framework_questionsfirst and stop the graph-write turn. Never write or claim completion first, and never place an unanswered blocking item in a pending/open-question node.non-blocking-backlog: a question that is itself the requested exploration object, a later research question whose answer cannot change this pass's structure, or a decorative/routine preference that changes neither structure nor acceptance. Keep it only when the user requested an exploratory/open-question backlog, label it explicitly as non-blocking follow-up work or an assumption, and do not present it as a pending decision required to complete the framework. Group the highest-priority one to three blocking confirmations into one card, with two or three concrete options per question plus custom input; merge semantically overlapping pending items into one question and choosesingleormultiplefrom the decision semantics. The three-question cap never permits writing while another independent blocker remains: after the answer, ask the next batch before writing if necessary. Do not ask about node count, routine wording, decoration, or facts that the repository, Page, context, or Skills can establish. After calling the tool, wait for its visible user-message response. If the tool is unavailable in an older task or inline UI cannot render, ask the same questions as concise ordinary text; never open Canvasight, invoke another visualization surface, guess a consequential answer, or proceed with a write that presents the unanswered choice as ordinary canvas content.
- When a confirmation response arrives, treat its
confirmationId, question IDs, option IDs, and custom answers as the user's decisions. Do not ask an answered question again. Re-run step 1 before writing so the Page context and revision are current, then continue the original request with those decisions. - Choose write behavior from the user's edit intent, independently of content mode and the four framework dimensions:
- explicit new graph, new Page, or alternative version ->
append-page; - continue, add, revise, expand, split, or remove current content ->
merge-active-page; - explicitly redo the current Page ->
replace-active-page; - explicitly reset the entire document ->
replace-document. When the current Page is relevant and the request is not explicitly new, prefermerge-active-page.
- explicit new graph, new Page, or alternative version ->
- Inspect saved templates with
list_canvasight_node_templates; fetch a full candidate withget_canvasight_node_templateonly when its summary is relevant. - Build
frameworkManifest,coverage, andsemanticRelationships:canvasight-default: keep the existing canonical primary-domain and maturity coverage rules, including the narrowerrefinecontract;skill-led: setcontentModeandcontentSkills, cover every Task Node created or updated by this write with responsibility-oriented keys, but do not manufacture Canvasight domain/maturity content or default guidance nodes. Asset Nodes may support that coverage as evidence/input, while Groups never satisfy responsibility coverage. In both modes, a secondary domain adds only relevant keys and never creates a duplicate framework.
- Assign node-level Skills only to Task Nodes and only as described in quality/skill-composition.md. Preserve user-written
$skill-nametokens in Task bodies. Record user-requested Task assignments asuser-explicit. Only whenpreferences.aiSkillAssignmentEnabledis true, querylist_canvasight_skillsby a Task responsibility and add anai-selectedassignment for an unambiguous description match, including a concrete rationale. Do not assign Skills to Asset/Group nodes or to every Task by default. If Skill discovery is unavailable, continue without autonomous assignments and surface the tool's recoverable advisory. - Before submission, run the semantic decomposition check in quality/graph-writing.md. Give each node one clearly named primary responsibility. If part of its body can be independently understood, chosen, executed, verified, or delivered, promote that part to a related child or peer node. Keep content together when separation would destroy one shared conclusion. Record compound-node responsibilities in
frameworkManifest.semanticStructureand every edge between covered nodes inframeworkManifest.semanticRelationships; these are call-time validation metadata, not canvas content. Choose the persisted object type deliberately: Task nodes own executable responsibilities; Asset nodes each reference one already managed.scatter/assetsfile; Group nodes provide one non-nested semantic container. Image, SVG, video, and ordinary-file presentation is inferred from that managed file and never selected through a node type,kind, or MIME authored by the AI. UseparentIdfor Task/Asset membership, never a containment Edge. Do not connect an Edge to a Group, invent an unmanaged asset path, create inline Task attachments, nest Groups, or assign one member to multiple Groups. Framework responsibility coverage remains Task-led; Assets may provide evidence/input and Groups never satisfy execution coverage by themselves. Persisted Assetroleis legacy compatibility only; express current meaning through Edge direction, labels, and context. - Call
write_canvasight_graph. Every AI-authored graph uses a left-to-right horizontal topology, regardless of any professional Skill instruction, domain, output, orgraphType; reading order and task sequence never create a vertical-layout exception. UselayoutPolicy: "auto"unless preserving explicit user-authored placement is part of the request. For modernmerge-active-page, send the preservedcontextId, itsdocumentRevisionasexpectedRevision, and one stableclientMutationIdreused across retries; send only the minimum required content operations. Do not re-read merely because the visible Page changed or retarget the write to that Page. Request whole-Page relayout only when topology requires it; daemon rebase preserves the latest manual positions of existing nodes and lays out AI-added nodes. - Treat
written,merged, andconflict-copyas successful writes. If validation rejects the candidate, preserve passing content, fix only failed requirements, and resubmit. Oncontext_expiredorpromotion_concurrent_conflict, re-read context, confirm the legacy attachment is still present, rebuild against the newly captured Page once, and submit with a new stable mutation ID; this recovery counts within the same three-total-attempt budget. Stop after three total attempts. Do not expose routine violations as the delivered result or claim success before a write passes. - Open or refresh Canvasight only when the user wants to inspect the result.
What ships with it
26 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/domains/article.md 1.2 KB
- references/domains/codebase.md 1.5 KB
- references/domains/research.md 1.3 KB
- references/domains/software-product.md 2.3 KB
- references/domains/task-execution.md 1.1 KB
- references/domains/ux-design.md 1.6 KB
- references/intents/analyze.md 683 B
- references/intents/create.md 792 B
- references/intents/decide.md 562 B
- references/intents/execute.md 657 B
- references/intents/organize.md 694 B
- references/intents/refine.md 1.1 KB
- references/maturity/decide.md 695 B
- references/maturity/define.md 761 B
- references/maturity/deliver.md 755 B
- references/maturity/explore.md 636 B
- references/node-types.md 3.5 KB
- references/outputs/decision-map.md 569 B
- references/outputs/execution-plan.md 661 B
- references/outputs/exploration-map.md 634 B
- references/outputs/structured-outline.md 961 B
- references/outputs/system-map.md 789 B
- references/quality/graph-writing.md 5.8 KB
- references/quality/skill-composition.md 3.6 KB
- references/quality/validation-repair.md 5.0 KB
- references/task-body-markdown.md 1.5 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 116 lines · 156 tokens per session scan A 962900391b38
canvasight-graph-writer is a skill published in the GitHub repository Niall-Young/Canvasight (210 stars, last pushed 14d ago), licensed MIT. It adds 156 tokens to every session and 3,426 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…