The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/excalidraw_lib.py script downloads community library files from raw.githubusercontent.com/excalidraw/excalidraw-libraries/main. This fetches resources from a well-known service for legitimate tool functionality.
[DATA_EXFILTRATION]: The skill documentation describes using curl to POST diagram JSON data to https://kroki.io/excalidraw/svg. While this involves sending local content to an external server, Kroki is a well-known and standard service for rendering diagram-as-code formats.
[COMMAND_EXECUTION]: The skill instructs the agent to execute excalidraw-brute-export-cli for local image rendering and scripts/excalidraw_lib.py for library management. These commands are necessary for the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: The skill implements a mechanism that ingests external data, creating a potential injection surface.
Ingestion points: The scripts/excalidraw_lib.py script fetches and parses .excalidrawlib JSON files from an external GitHub repository.
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore potentially malicious text content embedded within the downloaded library items.
Capability inventory: The skill environment allows for network operations (curl), file writing (json.dump), and subprocess execution (excalidraw-brute-export-cli).
Sanitization: The skill does not perform sanitization, filtering, or validation of the text fields within the downloaded library JSON before merging them into the active diagram scene.

excalidraw