The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs network requests to an external domain (tt-a1i.github.io) to check for available updates via scripts/check-update.mjs. It also allows fetching remote website icons and HTML during the brand capture process in renderers/shared/brand-marks.mjs, which targets user-provided URLs.
[COMMAND_EXECUTION]: High-privilege system commands are executed via node:child_process to support core functionality. This includes spawning git to verify source code references in renderers/shared/repository-evidence.mjs, launching headless Chrome/Chromium for visual containment checks in bin/visual-check.mjs, and utilizing powershell.exe on Windows to open generated artifacts in bin/open-artifact.mjs.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes diagram data and external website content. While the skill employs strict schema validation and HTML escaping, these ingestion points represent an attack surface for indirect prompt injection, where malicious instructions embedded in a diagram or remote site icon metadata could attempt to exploit the agent's file system and network capabilities.

archify