The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/pr-lens-setup.sh script installs the @coldtea/pr-lens-cli and playwright packages from the NPM registry. It also downloads the Chromium browser binary as part of the Playwright installation process.
[COMMAND_EXECUTION]: The build process in scripts/pr-lens-build.sh involves executing several local commands and utilities, including npx pr-lens for validation and rendering, and ffmpeg for encoding image frames into GIF and MP4 files.
[DYNAMIC_EXECUTION]: The skill uses a Node.js script (scripts/record.mjs) that leverages Playwright to load SVG files into a browser instance. It uses page.evaluate to programmatically step through SVG animations and page.screenshot to capture frames, which involves executing code within a browser automation context.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-influenced JSON data to generate visual diagrams. This represents a vulnerability surface where malicious content (e.g., scripts embedded in labels) could potentially be executed during the rendering phase in Playwright if not properly sanitized by the underlying CLI tool.
Ingestion points: The graph.json file, specifically the title, label, and subtitle fields within nodes, edges, and lanes (processed in scripts/pr-lens-build.sh).
Boundary markers: The data is structured as JSON, which provides basic syntactic boundaries.
Capability inventory: The skill can write files to the output directory and execute subprocesses including node, npx, and ffmpeg.
Sanitization: The pr-lens-build.sh script invokes npx pr-lens validate to check the JSON schema before rendering.

pr-lens-diagrams