The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries such as drawio, dot, and tred via subprocess.run. These calls are essential for exporting diagrams and calculating layouts. Analysis shows that inputs passed to these commands are either fixed arguments or programmatically generated strings (such as Graphviz DOT syntax) that are properly escaped to prevent command injection.
[EXTERNAL_DOWNLOADS]: The aiicons.py script fetches AI brand logos from unpkg.com and simpleicons.org. These are reputable Content Delivery Networks (CDNs) commonly used for icons and assets. The URLs are constructed using a bundled manifest (lobe-icons.json) or a hardcoded mapping, preventing the use of arbitrary or malicious URLs.
[SAFE]: The skill includes several utility scripts that enhance security and reliability, such as validate.py for structural linting of generated XML and repair_png.py to fix a known technical issue with truncated PNG files produced by the draw.io CLI.
[SAFE]: Instructions for installing prerequisites (draw.io, Graphviz) direct users to official repositories and standard package managers like Homebrew or apt, adhering to best practices for system software installation.

drawio-skill