The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the package @swiftlysingh/excalidraw-cli from the NPM registry using npx. This introduces a dependency on a third-party resource managed by an individual user account rather than a verified organization.
[COMMAND_EXECUTION]: The skill executes shell commands via npx to perform file conversions. This involves running code in the agent's environment to process data and generate image files.
[REMOTE_CODE_EXECUTION]: The use of npx to download and run a specific package identifier allows for the execution of remote code fetched from a public registry at runtime. While npx is a standard utility, executing unverified user-contributed packages poses a risk of supply chain attack if the package is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (descriptions, ASCII sketches) and passes it to a sub-agent (Haiku) to generate JSON files.
Ingestion points: Raw user input is ingested in Step 1 to create a layout brief.
Boundary markers: The skill lacks explicit instructions for the sub-agent to ignore potential instructions embedded within the user's diagram descriptions.
Capability inventory: The skill has the capability to write files and execute shell commands via the conversion tool.
Sanitization: No specific sanitization or escaping of user-provided labels is mentioned before they are incorporated into the generated JSON or the layout brief.

excalidraw-render