The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the drawio CLI for diagram exports and utilizes system-specific commands such as open, xdg-open, and start to display the generated files, as described in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx to fetch the @drawio/mcp package from the npm registry. This package is part of the well-known Draw.io service infrastructure.
[REMOTE_CODE_EXECUTION]: The skill uses npx to download and execute the @drawio/mcp package. As this package originates from a well-known service provider, the execution is documented neutrally as a functional requirement.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it generates diagrams from potentially untrusted external inputs like user requests or discovery data.
Ingestion points: The skill processes user-supplied requests and data from integration tools (e.g., pyats-topology) to build diagram content, as specified in SKILL.md.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are defined in SKILL.md for the data used to generate diagrams.
Capability inventory: The skill utilizes the agent's ability to write files to disk and execute shell commands (drawio CLI, npx) as documented in SKILL.md.
Sanitization: There is no mention of explicit sanitization, escaping, or validation of the input data before it is processed into diagram XML, Mermaid, or CSV formats.

drawio-diagram