The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render_diagram.py executes the Mermaid CLI (mmdc) or npx using subprocess.run. The command is constructed as a list, avoiding shell interpolation, which is a standard security practice for external tool invocation.
[EXTERNAL_DOWNLOADS]: If the Mermaid CLI is not present on the system, the skill uses npx to fetch the @mermaid-js/mermaid-cli package from the NPM registry. This is a well-known tool from a reputable organization.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to create diagrams. Ingestion points: The agent reads user-supplied source files or notes as defined in the grounding workflow in SKILL.md. Boundary markers: Instructions explicitly direct the agent to use plain text labels and disclose assumptions. Capability inventory: The skill includes file-writing and subprocess execution of the Mermaid CLI in scripts/render_diagram.py. Sanitization: The agent is instructed to quote human-facing labels and forbid HTML, scripts, click handlers, or remote resources within the diagram source.

to-diagram