The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the use of the official @drawio/mcp package via npx. The documentation provides guidance on pinning versions and verifying the publisher to manage supply chain security when running remote code.\n- [REMOTE_CODE_EXECUTION]: Configuration instructions and scripts recommend running the @drawio/mcp server using npx. This pattern involves executing remote code, but the source is a well-known vendor repository, and the instructions include best practices for version pinning.\n- [COMMAND_EXECUTION]: Utility scripts in Python are included to assist with configuring AI agent settings and validating diagram structure. These tools operate on local configuration files and project artifacts within the skill's defined workspace.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions to generate XML diagrams, representing a potential surface for prompt injection.\n
Ingestion points: User descriptions in the natural language prompt.\n
Boundary markers: Missing explicit delimiters to separate user input from generated XML structure.\n
Capability inventory: The open_drawio_xml tool can render arbitrary XML/HTML content in the browser.\n
Sanitization: Instructions mandate escaping special characters in XML attributes to prevent structural corruption.\n- [SAFE]: Integration scripts access AI agent configuration files solely for the purpose of registering the MCP toolset. The skill appropriately documents the trust boundaries associated with both local and vendor-hosted diagram rendering services.

drawio-architecture