The Agent Skills Directory

[SAFE]: The skill provides utility scripts and theme templates for diagram styling. All code is localized to the skill directory, and no network operations or suspicious exfiltration patterns were found.\n- [COMMAND_EXECUTION]: The derive_palette.py script executes the ffmpeg binary to process image and video files from a user-provided directory.\n
Evidence: subprocess.run(["ffmpeg", "-v", "error", "-i", str(path), ...], capture_output=True)\n
Analysis: The execution uses a list of arguments and does not invoke a shell, which prevents command injection. The usage is restricted to extracting pixel data for palette analysis as described in the skill documentation.\n- [PERSISTENCE]: The to_diagram_design.py script can write configuration files to the user's home directory.\n
Evidence: The script writes to ~/.diagram-design/profiles/ and creates project markers.\n
Context: This is a legitimate feature for integrating with the external diagram-design tool and is only performed when the user explicitly provides the --write flag.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by processing external files supplied by the user.\n
Ingestion points: Moodboard folders in derive_palette.py and Markdown/JSON theme files in design_tokens.py.\n
Boundary markers: No explicit delimiters or boundary markers are used when processing these files; however, the scripts only perform quantitative analysis or schema validation.\n
Capability inventory: The skill can execute ffmpeg (command execution) and write files to specific configuration paths.\n
Sanitization: Slugs used for file generation in to_diagram_design.py are sanitized using regular expressions (^[a-z0-9][a-z0-9-]{0,63}$) to prevent path traversal or naming collisions.

diagram-design-system