The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/render.ts file contains an ensurePackage function that dynamically installs the beautiful-mermaid package using npm install or bun add via child_process.execSync. This runtime dependency installation lacks version pinning and relies on the integrity of public package registries at execution time.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Mermaid diagram code which is rendered to SVG and subsequently embedded into an HTML wrapper by scripts/create-html.ts. The SVG content is interpolated directly into the HTML without sanitization. This creates an XSS vulnerability where malicious Mermaid code could generate an SVG with embedded scripts that execute when the agent-browser tool opens the generated HTML file.
[COMMAND_EXECUTION]: The skill's workflow involves frequent use of shell commands such as bun run, npx tsx, and rm to manage the rendering process and clean up temporary files. While these are functional requirements, they represent a broad execution surface.
[EXTERNAL_DOWNLOADS]: The skill attempts to fetch the beautiful-mermaid library from external package registries during the diagram rendering process if it is not already present in the environment.

beautiful-mermaid