The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the third-party npm package @kitschpatrol/tldraw-cli to function. It also instructs the agent to use npx puppeteer to download specific versions of the Chrome browser into the user's cache directory.
[COMMAND_EXECUTION]: The skill uses shell commands to manage its lifecycle and produce outputs. This includes npm install -g for dependency management, the tldraw CLI for diagram processing, and OS-native commands like open, xdg-open, and start to display the final files to the user.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions to create visual diagrams and then uses a vision-enabled model to inspect those diagrams for errors. This creates a potential vector where user-supplied text could attempt to influence the agent's behavior during the self-check phase.
Ingestion points: User-supplied diagram requirements and labels enter the workflow through the 'Workflow' and 'Review Loop' sections.
Boundary markers: The instructions do not define specific delimiters or guardrails for how user input is handled before being rendered into the diagram source or the final image.
Capability inventory: The skill has the ability to execute shell commands (tldraw, npm, npx), write JSON files to the disk, and create directories (mkdir -p).
Sanitization: No explicit sanitization or filtering of user-supplied text is mentioned before it is embedded in the .tldr file format or rendered into PNG/SVG images.

tldraw-skill