The Agent Skills Directory

[COMMAND_EXECUTION]: The utility script render-graphs.js uses child_process.execSync to run the system dot command for rendering Graphviz diagrams. This is a legitimate development tool used for visualizing skill workflows.
[DYNAMIC_EXECUTION]: The script render-graphs.js dynamically extracts content from markdown blocks and processes it through an external executable, which is consistent with its stated purpose as a diagram rendering utility.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where render-graphs.js processes external markdown files to extract Dot code.
Ingestion points: The script reads SKILL.md files provided as command-line arguments.
Boundary markers: The script identifies content within ```dot code blocks.
Capability inventory: The script has the ability to execute the dot system command and write SVG files to the local filesystem (fs.writeFileSync).
Sanitization: The script passes the extracted content to the dot command via standard input (stdin) rather than shell interpolation, which prevents common shell injection vulnerabilities.

writing-skills