The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses spawnSync to execute Node.js sub-processes for rendering and validation tasks. It also executes git commands via spawnSync to verify 'repository evidence' against local Git checkouts. These operations are integral to the skill's primary purpose of generating and verifying diagrams based on actual code.
[DYNAMIC_EXECUTION]: Internal components, such as validators and guide recipes, are loaded dynamically using import() with computed paths. These paths are safely derived from the skill's installation directory.
[EXTERNAL_DOWNLOADS]: The skill includes an update awareness mechanism (scripts/check-update.mjs) that periodically fetches a version manifest from the author's official GitHub Pages repository to notify the user of new releases.
[EXTERNAL_DOWNLOADS]: The 'brand capture' feature allows the agent to fetch external website icons to enhance diagrams. This functionality includes extensive SSRF (Server-Side Request Forgery) protections, including a blocklist for private IP ranges, credentials, and non-standard ports.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON data to produce diagrams. This ingestion surface is well-mitigated through strict JSON Schema validation using the ajv library and thorough HTML entity escaping to prevent cross-site scripting (XSS) in the generated output.

archify