The Agent Skills Directory

[COMMAND_EXECUTION]: The script executes external tools such as the Mermaid CLI and Node.js via subprocess.run. It securely passes arguments as a list rather than using a shell string, which prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill requires installing standard, well-known packages from public registries (NPM and PyPI), such as @mermaid-js/mermaid-cli and python-docx. These downloads follow standard development workflows and target reputable sources.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Markdown documents, creating a potential vector for indirect prompt injection if the input contains malicious instructions designed to be interpreted by the agent during the conversion process.
Ingestion points: Untrusted content is read from input files in scripts/markdown_to_word.py using input_path.read_text().
Boundary markers: There are no explicit markers or instructions advising the agent to disregard directives embedded within the source files.
Capability inventory: The skill has access to file system operations (os.link, os.rename, Path.write_text), ZIP archive manipulation, and external process execution via subprocess.run.
Sanitization: The tool implements basic HTML stripping and uses a hardened XML parser (resolve_entities=False, no_network=True) for diagram validation, though it does not perform deep semantic analysis of the Mermaid source fences before rendering.

markdown-to-word-mermaid