The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the find command to search for a plugin directory (PLUGIN_DIR) and then executes bash "$PLUGIN_DIR/scripts/ensure-deps.sh". Executing scripts from paths resolved at runtime via broad filesystem searches poses a risk of executing unintended or malicious code if a directory matching the search pattern is present in the user's home folder.
[REMOTE_CODE_EXECUTION]: The skill dynamically loads and executes shell scripts (ensure-deps.sh) and markdown-based instruction files (specialists and policies) from paths computed at runtime. This behavior is equivalent to dynamic code loading and can lead to execution of untrusted content if the environment is compromised.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It is designed to ingest and "diagram the flow" of user-provided files or scripts. If these files contain malicious instructions hidden in comments or metadata, the agent may follow those instructions instead of performing the diagramming task.
Ingestion points: Processes $ARGUMENTS (user description) and external code/scripts provided by the user for flow analysis.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: The skill has access to Bash, Read, and Write tools, including the ability to run arbitrary shell commands and the d2 CLI.
Sanitization: No evidence of sanitization or validation of the input scripts or descriptions before processing them through the LLM context.

d2-diagram