The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The rendering pipeline fetches the Excalidraw library from the esm.sh content delivery network. Additionally, the setup instructions involve downloading the Chromium browser via the Playwright CLI, which is a common developer tool from a well-known service.
[REMOTE_CODE_EXECUTION]: The skill uses Playwright to execute JavaScript within a headless Chromium instance to render diagrams. The rendering logic is defined in render_template.html and triggered via assembly of a JavaScript string in render_excalidraw.py.
[COMMAND_EXECUTION]: The skill workflow requires the agent to execute a Python script (render_excalidraw.py) to generate visual output for validation, which involves subprocess execution and file system interaction for reading JSON and writing PNG files.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes and incorporates untrusted text from user prompts and external technical documentation (researched at runtime) into the final diagram JSON.
Ingestion points: User-provided descriptions and technical research data gathered by the agent from external sources.
Boundary markers: The skill does not define specific delimiters or "ignore instructions" warnings for the content placed within the Excalidraw JSON structure.
Capability inventory: The agent can perform file system writes (JSON and PNG), execute local scripts, and initiate network requests via the headless browser instance.
Sanitization: There is no evidence of explicit sanitization or filtering of external content before it is interpolated into the diagram elements.

excalidraw-diagram