The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run local Python scripts, specifically scripts/add-icon-to-diagram.py and scripts/add-arrow.py, to automate the construction of diagram files.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for users to download icon libraries from https://libraries.excalidraw.com/ and references the main application at https://excalidraw.com, which are well-known services relevant to the skill's functionality.
[PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection where user-supplied content is used in high-privilege operations.
Ingestion points: The skill processes natural language descriptions from users to extract entities and labels (Step 1 and Step 3).
Boundary markers: No delimiters or explicit instructions are provided to the agent to treat user-supplied text as untrusted data.
Capability inventory: The skill has the capability to execute shell commands to run Python scripts that modify the file system.
Sanitization: There is no evidence of sanitization or escaping of user-supplied strings before they are passed as command-line arguments (e.g., the --label flag), which could lead to command injection.

excalidraw-diagram-generator