The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python validation script (scripts/validate_diagram.py) and recommends using standard diagramming command-line tools (D2, Graphviz, Mermaid CLI, Structurizr) for rendering and syntax verification. All tools are intended to run in the local project environment.
[SAFE]: The skill implements strong security best practices, including mandatory XML and JSON escaping for user-provided data and a structural validation script that identifies and blocks potentially malicious elements like tags or event attributes in SVG and Structurizr files.
[PROMPT_INJECTION]: The skill processes user-supplied text and data to generate diagram source files, representing an indirect prompt injection attack surface. This risk is mitigated through comprehensive sanitization instructions and validation rules. 1. Ingestion points: User-provided text, code, and data tables via the primary skill instructions. 2. Boundary markers: Explicit instructions to use boundary markers and perform XML/JSON escaping. 3. Capability inventory: Local script execution and CLI-based diagram rendering tools scoped to the project directory. 4. Sanitization: Structural validation via a dedicated script to exclude active elements and verify file integrity.

diagram-creator