The Agent Skills Directory

[DYNAMIC_EXECUTION]: Several scripts in the skill's utility suite use the importlib.util module to dynamically load and execute other bundled Python files from the skill's own directory. This mechanism is used to manage internal dependencies like layout logic and validation routines at runtime.
Evidence: Detected in autolayout.py, c4.py, edgeports.py, raster2drawio.py, and tfstate.py where modules like validate.py and tfimports.py are loaded from computed paths.
[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to run external system binaries and coordinate internal scripts, which is necessary for its core diagramming and analysis features.
Evidence: Executes the drawio desktop CLI for image exports, Graphviz dot and tred for automated graph layout, and git for codebase history extraction.
[EXTERNAL_DOWNLOADS]: The skill fetches brand icons and data store logos from external content delivery networks during diagram generation to provide accurate iconography.
Evidence: scripts/aiicons.py uses urllib.request.urlopen to download SVG assets from unpkg.com and cdn.simpleicons.org.
[INDIRECT_PROMPT_INJECTION]: The skill has a large ingestion surface as it parses untrusted data from local repositories to generate diagrams, creating a surface for indirect instructions to influence agent behavior.
Ingestion points: Extraction scripts like pyimports.py, jsimports.py, tfimports.py, and sqlerd.py read and analyze project file contents (Python, JS, Terraform, SQL) and directory structures.
Boundary markers: Absent. The skill parses external content directly without wrapping it in defensive delimiters or security-focused parsing contexts.
Capability inventory: The skill possesses broad capabilities including file read/write operations, network access for asset retrieval, and the ability to execute system-level commands via subprocess.
Sanitization: Partial. While the skill uses the Python ast module for secure import analysis and standard XML/HTML escaping for diagram labels, it lacks universal sanitization for all processed input formats.

drawio-skill