The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Node.js and Python scripts to perform diagram generation, linting, and font subsetting. It also spawns a local Chromium-based browser to render SVG files to PNG format. All spawned processes use argument arrays with spawn or spawnSync, preventing shell-based command injection. Executable paths are either resolved from the system PATH, documented standard installation locations, or user-provided environment variables.
[EXTERNAL_DOWNLOADS]: The skill relies on Node.js and a Chromium-based browser being installed on the system. If Node.js is missing, it provides instructions for installation via the system's trusted package manager (e.g., brew, apt) and only proceeds if the user explicitly approves the change. It explicitly avoids remote curl | sh installers.
[DYNAMIC_EXECUTION]: The package includes internal auditing logic (importClosure) that scans its own production code to ensure only Node.js built-ins and package-local modules are imported. It specifically detects and rejects non-static dynamic imports to prevent execution of arbitrary code.
[SAFE]: The skill implements a comprehensive 'preflight' system that calculates SHA-256 digests for all package files. This ensures that the code and configuration haven't been tampered with. Additionally, it uses 'receipts' to cryptographically bind the output artifacts to the specific inputs and tool versions used, providing transparency and verification of the generation process.
[SAFE]: The skill avoids third-party Node.js dependencies entirely, utilizing only the standard library to minimize its attack surface. It also avoids loading remote fonts or scripts during the diagram rendering process.

svg-infographic