The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads pinned versions of visualization libraries and a headless browser executable from official registries (npmjs.org) and well-known cloud providers (storage.googleapis.com) to establish a local rendering environment.
[COMMAND_EXECUTION]: The skill uses the local Node.js runtime to execute its internal validation, setup, and rendering scripts. These scripts manage dependencies using npm ci with script execution disabled and perform diagram generation using a verified internal version of the Mermaid CLI.
[PROMPT_INJECTION]: The skill processes external Mermaid source code, creating a potential surface for indirect prompt injection. This is mitigated by comprehensive static analysis that rejects remote resources and unsafe configuration directives before rendering.
Ingestion points: scripts/mermaid/validate.mjs (Mermaid source path) and scripts/html/extract-mermaid.mjs (HTML input path).
Boundary markers: Enforces standard Mermaid syntax delimiters and frontmatter structures.
Capability inventory: Subprocess execution via spawn for rendering and file system operations.
Sanitization: Employs an internal validator to enforce strict security levels and block all remote or embedded executable content.

ptlam-visualization