The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local Node.js script (scripts/excalidraw-visuals/generate-visual.js) to handle the image generation process. The agent executes this script via the shell to communicate with the external API and save the resulting image.
[EXTERNAL_DOWNLOADS]: The generation script fetches reference images and the final generated diagrams from external URLs. Specifically, it interacts with fal.ai infrastructure to submit jobs and retrieve image data. It also allows the use of an external reference image provided via URL.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests user-provided concepts and labels to build a prompt for an external AI model (Flux Schnell).
Ingestion points: User input gathered in Step 1 of SKILL.md (concept, elements, labels).
Boundary markers: The skill uses a 'LOCKED' Style Prefix and a rigid prompt structure to constrain the output, effectively serving as a boundary for the injected content.
Capability inventory: The skill possesses file-writing capabilities (saving PNGs to projects/excalidraw-visuals/) and network capabilities (HTTPS requests to fal.ai and reference URLs) via the generate-visual.js script.
Sanitization: There is no explicit sanitization of the user input before interpolation, but the impact is minimized as the downstream consumer is an image generation model, not a text model or shell environment.

excalidraw-visuals