The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The setup.mjs script contains a hardcoded pre-shared key processon_mcp_psk_2026. This secret is used to generate encrypted codes for the authorization flow.
[DYNAMIC_EXECUTION]: The skill utilizes node -e to execute JavaScript code snippets. This occurs in SKILL.md for fetching version metadata and in setup.mjs via a fallback execution script used to communicate with the ProcessOn API.
[COMMAND_EXECUTION]: The setup.mjs script performs shell command execution using spawn and spawnSync to interact with npm, node, and the mcporter utility.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to the author's GitHub repository to check for updates and uses npx to dynamically install the mcporter package from the npm registry.
[INDIRECT_PROMPT_INJECTION]: The skill processes natural language input from users to generate diagrams, representing a potential surface for injection given its access to shell and network resources.
Ingestion points: User-provided diagram descriptions are passed as arguments to the processon_generate_chart function in setup.mjs.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are used when interpolating user data.
Capability inventory: The skill can execute shell commands, write files to the home and temporary directories, and perform network requests to the ProcessOn API.
Sanitization: The skill implements basic shell argument quoting for Windows compatibility but does not sanitize the semantic content of user prompts.

processon-diagram-generator