The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/mermaid.py utility invokes the Mermaid CLI (mmdc) via subprocess.run to render diagrams from code blocks. The command is constructed as a list, which is a secure practice to prevent shell injection, and the binary path is verified before execution.
[EXTERNAL_DOWNLOADS]: Documentation and snippets recommend downloading citation style (CSL) files from the official citation-style-language GitHub repository and utilizing the Kroki API for diagram generation. These are reputable, well-known services commonly used in document processing workflows.
[REMOTE_CODE_EXECUTION]: The provided assets/templates/Makefile contains a setup target designed to download a validation script. This target uses a placeholder URL (your-repo) and serves as a template for user configuration rather than a mechanism for automated or hidden code execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes external Markdown files which may contain untrusted content. It uses scripts/validate.py to check YAML frontmatter syntax and file dependencies. While this introduces an attack surface common to document processors, the skill's capabilities are focused on formatting and conversion rather than privileged system operations.

pandoc