The Agent Skills Directory

[COMMAND_EXECUTION]: The utility scripts scripts/extract_mermaid.py, scripts/mermaid_to_image.py, and scripts/resilient_diagram.py use subprocess.run to execute the Mermaid CLI (mmdc). These commands are used to validate Mermaid syntax and render diagrams into image formats. The command arguments are strictly controlled, utilizing sanitized file paths and predefined CLI flags to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill is designed to use the @mermaid-js/mermaid-cli package. The scripts are configured to automatically fetch this package from the official npm registry via npx if it is not found on the local system. This represents standard behavior for rendering tools and targets a well-known, trusted service.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (Mermaid diagram code) which introduces a vulnerability surface.
Ingestion points: User-supplied strings via the --code argument or content read from files via the --mmd-file argument in scripts/resilient_diagram.py.
Boundary markers: User content is isolated within temporary or dedicated .mmd source files before processing.
Capability inventory: The scripts have the ability to execute subprocesses and perform filesystem write operations in the scripts/ and docs/architecture/ directories.
Sanitization: Filenames constructed from user input are sanitized using a strict regular expression ([^a-zA-Z0-9_-]), and diagram content is passed to an external, specialized parser (mmdc) rather than a general-purpose shell or interpreter.

mermaid-architecture