The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the TLA+ TLC tool and Java runtime from official GitHub repositories and established sources using the mise tool. It also installs the pele and @resvg/resvg-js libraries from the NPM registry as needed for rendering charts.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded model checker (via Java) and rendering packages to perform its primary function of generating statecharts from TLA+ models.
[COMMAND_EXECUTION]: The scripts use spawn and spawnSync in scripts/statechart.mjs and scripts/tlc-tools.mjs to run the Java-based TLC model checker and other helper utilities, using arguments derived from local specification and configuration files.
[DYNAMIC_EXECUTION]: The tool uses dynamic import() to load rendering components and user-supplied labeling modules (.map.mjs). These imports are resolved from the local file system based on the project structure.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data.
Ingestion points: scripts/statechart.mjs processes content from .tla, .cfg, .map.mjs, and .mmd files provided by the user.
Boundary markers: No explicit boundary markers or instructions are used to isolate untrusted content from the agent's instructions in the final output.
Capability inventory: The skill has significant capabilities, including executing shell commands (spawn), performing file system operations (read/write/delete), and importing JavaScript modules.
Sanitization: The skill performs Mermaid-specific escaping (escapeMermaidQuotes) but does not sanitize content against malicious instructions intended for the AI agent.

statechart