The Agent Skills Directory

[COMMAND_EXECUTION]: The script drawio-to-png.mjs executes the drawio command-line utility via spawnSync to perform diagram exports. It also uses system utilities like where or which to locate the binary on the host system.
[EXTERNAL_DOWNLOADS]: When using the headless browser rendering path, the skill fetches the official rendering engine (viewer-static.min.js) from https://viewer.diagrams.net. This is a well-known service provided by the draw.io project.
[DYNAMIC_EXECUTION]: The skill uses puppeteer-core to launch a headless browser and injects diagram content into an HTML template for rendering. It executes JavaScript within the browser context to interact with the draw.io viewer engine.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process diagram XML data which may be generated based on untrusted user prompts.
Ingestion points: The drawio-to-png.mjs script reads .drawio files, which contain XML formatted diagram data.
Boundary markers: None identified for the XML data content validation.
Capability inventory: The skill has access to the file system (readFileSync, writeFileSync), command execution (spawnSync), and network access via the headless browser.
Sanitization: The script performs escaping of backticks, dollar signs, and backslashes before embedding diagram content into the rendering HTML template to prevent script breakout in the browser context.

drawio