The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill depends on established libraries (mermaid, jsdom, playwright-core) managed via the NPM registry. These are standard tools for its stated purpose of diagram linting and browser-based verification.
[COMMAND_EXECUTION]: The selftest.mjs file uses execFileSync to run the skill's own Node.js script in a subprocess. This is a restricted, local execution used solely for verifying that the linter correctly identifies syntax errors during setup.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from local files and web pages, creating a potential surface for indirect prompt injection.
Ingestion points: mermaid_lint.mjs reads local Markdown files; readback.mjs reads content from external GitHub URLs.
Boundary markers: No specific boundary markers are used to separate extracted diagram code from other instructions in the prompt context.
Capability inventory: Includes file system read access and network read access to GitHub. The skill does not have file-write or general command execution capabilities.
Sanitization: Input is validated using the mermaid.parse library, which ensures the content adheres to the Mermaid grammar and does not contain arbitrary executable logic.
[DATA_EXFILTRATION]: The skill performs network requests to verify GitHub diagram rendering. It does not transmit sensitive local data (such as environment variables or credentials) to external servers; its network operations are strictly limited to the tool's core functionality.

mermaid-lint