The Agent Skills Directory

[SAFE]: The skill follows best practices for generating static visual content and includes a local validation script for data integrity. No malicious behavior or security risks were identified.
[COMMAND_EXECUTION]: The skill includes a local Python script (scripts/check-diagram-brief.py) for validating diagram brief files. This script uses only standard library modules and performs structural checks on JSON data. The skill also includes unit tests (tests/test_check_diagram_brief.py) that use subprocess.run to execute the local validation script; this is a standard development practice and does not introduce security vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection as it processes external text to generate diagrams.
- Ingestion points: User-provided text, notes, and articles provided in the input prompt (processed according to SKILL.md).
- Boundary markers: The agent is instructed to transform input into a structured JSON 'brief' using the provided template (assets/diagram-brief-template.json), isolating raw input from the final rendering process.
- Capability inventory: The skill creates static text files (.svg, .mmd) and executes a local validation script (scripts/check-diagram-brief.py) with no network access.
- Sanitization: Structural validation and ID consistency checks are performed by the provided validation script before the diagram is rendered.

zukai-creator