The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md direct the agent to execute the shell command node screenshot-diagram.js <diagram-name>. Since the <diagram-name> is derived from user input or the workflow description, the absence of sanitization or quoting requirements in the instructions creates a vulnerability where a maliciously crafted diagram name could lead to arbitrary command execution on the host system.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input to generate the content of workflow diagrams.\n
Ingestion points: Workflow descriptions are collected from the user in SKILL.md (Phase 1).\n
Boundary markers: None provided. The instructions do not specify the use of delimiters or 'ignore' instructions for the content being processed.\n
Capability inventory: The skill writes user-provided labels and details to a local diagram.html file and subsequently executes a Node.js script that renders this file using Playwright (a headless browser).\n
Sanitization: There are no instructions for the agent to sanitize, escape, or validate the user-provided text before interpolating it into the HTML template. This allows for HTML/Script injection attacks where a user could provide a description containing <script> tags that would be executed by the browser during the automated screenshot process.\n- [EXTERNAL_DOWNLOADS]: The skill's setup process involves installing the playwright package and its Chromium browser dependency. These resources are provided by Microsoft, a well-known organization, and the operations are documented clearly in the README.md and package.json files.

create-workflow-diagram