The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/render.ts includes functionality to download and install the beautiful-mermaid package from the NPM registry if it is not present and the --allow-install flag is enabled.- [COMMAND_EXECUTION]: The scripts/render.ts file uses node:child_process's spawnSync to execute shell commands like npm install and bun add for runtime dependency management.- [REMOTE_CODE_EXECUTION]: The skill uses dynamic import() in scripts/render.ts to load and execute the beautiful-mermaid package after it has been downloaded from an external registry.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) when processing diagram source code.
Ingestion points: Untrusted Mermaid source code is ingested via the --code or --input arguments in scripts/render.ts.
Boundary markers: The skill does not use delimiters or explicit instructions to ignore embedded commands within the Mermaid source.
Capability inventory: The skill has the ability to write files to the system and execute shell commands via scripts/render.ts.
Sanitization: There is no evidence of validation or sanitization of the Mermaid source code before it is passed to the renderer.

beautiful-mermaid