The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/render.ts contains an ensurePackage function that uses node:child_process.execSync to run npm install or bun add for the beautiful-mermaid package if it is not found locally. This allows for the download and execution of external code during skill operation.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch the beautiful-mermaid dependency from the public NPM registry at runtime. This package is a resource associated with the skill's vendor.
[COMMAND_EXECUTION]: The rendering workflow relies on several shell commands, including script execution via bun or npx tsx, and browser automation commands through the agent-browser skill to capture screenshots.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of Mermaid diagram code or natural language descriptions, which are then processed and rendered.
Ingestion points: Mermaid code is accepted via CLI arguments (--code) or read from input files (--input) in scripts/render.ts.
Boundary markers: There are no explicit markers or safety instructions used to isolate the user-provided Mermaid syntax from the rest of the processing logic.
Capability inventory: The skill has capabilities for file system writes (writeFileSync), subprocess execution (execSync), and browser manipulation (agent-browser).
Sanitization: The skill does not perform validation or sanitization of the Mermaid code before it is passed to the rendering engine or embedded into the HTML wrapper in scripts/create-html.ts.

beautiful-mermaid