The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the TLA+ toolset (tla2tools.jar) from its official GitHub repository and utilizes the mise tool manager to install Java (Temurin). These downloads are performed from well-known technology providers and are essential for the skill's functionality.
[COMMAND_EXECUTION]: The skill invokes several subprocesses, including java for model checking and various JavaScript runtimes (node, bun, or deno) for internal script processing and user-provided view logic.
[DYNAMIC_EXECUTION]: The skill dynamically loads a user-provided JavaScript or TypeScript module (the 'view' file) using the import() function. This mechanism allows users to customize the statechart generation and is a documented core feature. The skill includes a checkView function to validate the exported structure of these modules.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided TLA+ specifications and configuration files, creating an attack surface for indirect prompt injection. It possesses capabilities to interact with the file system and execute subprocesses based on the results of processing this untrusted data.
Ingestion points: Untrusted data enters the skill via user-provided .tla files, .cfg configuration files, and custom view modules.
Boundary markers: The skill does not implement explicit boundary markers or 'ignore' instructions for the data being processed.
Capability inventory: Includes the ability to spawn subprocesses (Java and shell commands), perform file system operations (read and write access to temporary and output directories), and dynamic module loading.
Sanitization: The skill performs structural validation of the user-provided view module and parses TLA+ configuration files to ensure they conform to expected naming and value constraints.

statechart