The Agent Skills Directory

[METADATA_POISONING]: The skill includes frontmatter fields such as verified: true and trust_score: 100. These claims are not verifiable within the skill content and may mislead users or agents regarding the safety or authoritative status of the skill.
[DYNAMIC_EXECUTION]: The entry point script scripts/main.cjs uses the spawn method to execute a secondary script (generate.mjs). It passes all command-line arguments directly to this process (...args), which can lead to unintended execution behaviors if the agent provides unvalidated or malicious argument strings.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes codebase structures and component relationships to generate Mermaid diagrams and standalone HTML files. There is a risk that malicious data within the analyzed codebase (such as crafted comments or identifiers) could influence the generated output or exploit the rendering environment.
Ingestion points: Scans project files and identifies components using pnpm search:code and tool-based file reads as defined in SKILL.md.
Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions within analyzed code are present.
Capability inventory: The skill uses spawn in scripts/main.cjs and has access to Read, Write, Glob, and Grep tools.
Sanitization: The skill lacks documentation or logic for sanitizing code content before interpolating it into Mermaid syntax or the HTML export template.
[EXTERNAL_DOWNLOADS]: The HTML export functionality fetches the Mermaid.js library from a public CDN (https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js). This is a reference to a well-known service for hosting legitimate open-source dependencies.

diagram-generator