The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a helper script scripts/verify_mermaid.py used to validate diagram syntax. It utilizes subprocess.run to call the Mermaid CLI (mmdc). The script is implemented securely by passing arguments as a list and avoiding the use of a shell (shell=False), which effectively prevents command injection attacks.
[EXTERNAL_DOWNLOADS]: The instructions direct the agent to use search_web to retrieve the latest Mermaid documentation. This is a legitimate and safe use of a platform tool to ensure generated diagrams adhere to current standards.
[INDIRECT_PROMPT_INJECTION]: As the skill's primary function is to process user requirements and generate documentation, it naturally ingests untrusted data. Although it lacks explicit sanitization or boundary markers for these inputs, the skill's defined capabilities (writing to a docs/ folder and validating syntax) do not pose a high risk of malicious exploitation in the context of business analysis.

business-analysis