The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill suite is designed to ingest and process untrusted user data—such as source code, JSON structures, and experimental metadata—to generate visual diagrams. This creates a surface for indirect prompt injection where malicious instructions could potentially be embedded in the processed data.
Ingestion points: code-flow-visualizer/SKILL.md (analyzes user-provided Python/JS/TS source code), json-data-visualizer/SKILL.md (visualizes JSON/YAML/CSV data), and scientific-illustration-guide/SKILL.md (processes structural component lists).
Boundary markers: No explicit instructions or delimiters are provided to the agent to ignore instructions that might be embedded within the data to be visualized.
Capability inventory: The skills perform local file operations (writing PDF, SVG, PNG, and JSON files via Matplotlib and standard file I/O) and network operations (sending data to external rendering APIs).
Sanitization: No explicit sanitization or validation of input content was observed in the provided code snippets.
[EXTERNAL_DOWNLOADS]: The kroki-diagram-api skill communicates with an external rendering service to transform diagram text into images.
Evidence: The skill makes network requests to https://kroki.io using requests.post and curl. This is the documented and intended communication channel for this well-known diagramming service.
[COMMAND_EXECUTION]: The documentation and guides include instructions for using standard package managers and CLI tools to install and run visualization utilities.
Evidence: Examples include npm install -g @mermaid-js/mermaid-cli for diagram rendering and pip install commands for various Python visualization libraries.

diagram-skills