Panno canvas

Skill Panno-ai/skills/skills/panno-canvas

Interact with a Panno infinite canvas via REST API using curl. Use this skill whenever the user wants to create, read, update, or delete shapes on a Panno canvas — including markdown content, geometric shapes, notes, and file editors. Also handles canvas authentication (guest session, API key, OAuth sign-in), layout, responding to comment threads, and the diff/patch workflow for proposing content changes.From its SKILL.md

Install

npx -y skills add Panno-ai/skills --skill panno-canvas

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.3 KB, 334 tokens by cl100k_base, as published. Nobody here has run it

Panno Canvas

Interact with a Panno infinite canvas via its REST API using curl.

Getting started

Load references/cli-agent-instructions.md for:

Authentication setup (API key, OAuth sign-in, guest session)
All REST API endpoints with curl examples
Token management and refresh

Shape types & properties

Load references/shape-schemas.md for the full property reference for each shape type: geo, text, note, panno-markdown, draw, panno-comment, panno-app-runtime, panno-app-editor, panno-file-editor.

Key rules:

The text prop was removed in tldraw v4. Never provide text or richText on shapes — use panno-markdown with the content prop for text content.
Always read the canvas first to understand existing context before making edits.
Use panno-markdown type for rich content (supports full markdown).

Layout best practices

Load references/layout-patterns.md for guidance on:

Avoiding shape overlap
Grid and flow-based arrangements
Grouping related content
Quadrant placement and flow direction

Comment interaction

Load references/comment-patterns.md for:

Responding to comment threads via the prompts API
Using procedural UI components for structured user input
Cursor chat escalation patterns

Markdown shape workflow

Load references/markdown-workflow.md for:

Creating and updating markdown shapes
Diff/patch workflow for proposing content changes

What ships with it: 5 files

18.3 KB alongside SKILL.md

references/

Gives 0 of the 12 instructions most auth identity skills give in 334 tokens

Counted across 408 of the 432 authors here whose files we hold, read 2026-09-06

Use parameterized queries for all SQL and database access to prevent SQL injectionin 60 of 408, across 40 files
Hash passwords with bcrypt or Argon2idin 50 of 408, across 34 files
Store secrets in Vault or environment variablesin 37 of 408, across 17 files
Add security headers to all responsesin 28 of 408, across 14 files
Rate limit public endpoints per clientin 22 of 408, across 8 files
Store tokens in httpOnly cookiesin 21 of 408, across 16 files
Use HTTPS in productionin 17 of 408, across 4 files
Apply rate limiting to all API endpointsin 17 of 408, across 9 files
Validate all input with Bean Validationin 16 of 408, across 3 files
Enable JWT or OIDC for stateless authenticationin 15 of 408, across 2 files
Scan dependencies for CVEsin 15 of 408, across 2 files
Log audit records for sensitive operationsin 15 of 408, across 2 files

Said here and by no other author read

Interact with the canvas via REST API using curl
Read the canvas before making edits
Use panno-markdown with the content prop for text content

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.