The Agent Skills Directory

[DATA_EXFILTRATION]: The helper script scripts/make_excalidraw_clipboard.py implements a file-reading mechanism in the make_file function. It uses Path(item["path"]).read_bytes() to read data from a path provided in the input JSON specification. This data is subsequently encoded into a Data URL (Base64) and included in the clipboard JSON. The skill instructions guide the agent to write this JSON to the system clipboard and paste it into the Excalidraw website, which facilitates the exfiltration of arbitrary local file contents to a third-party domain.
[COMMAND_EXECUTION]: The skill executes a local Python script scripts/make_excalidraw_clipboard.py to generate clipboard data. This script performs filesystem operations (file reads) that are driven by the contents of a specification file, which may be influenced by external or untrusted data.

excalidraw-visual-designer