The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/convert.py utilizes subprocess.run() with a list of arguments to execute the npx command. This approach is a secure practice that prevents shell injection vulnerabilities by ensuring that user-provided file paths are treated as arguments rather than executable shell code.\n- [EXTERNAL_DOWNLOADS]: The skill triggers the download and execution of the @mermaid-js/mermaid-cli package via npx. This package is fetched from the official NPM registry, which is an established and well-known service for software distribution.\n- [PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection because it processes user-provided Mermaid diagram files.\n
Ingestion points: The agent is instructed in references/fallback-tree.md to read the contents of .mmd files for troubleshooting purposes if conversion fails.\n
Boundary markers: There are no explicit delimiters or instructions defined to isolate the diagram source code or to instruct the agent to ignore any embedded natural language instructions.\n
Capability inventory: The agent has access to the Bash tool and specialized conversion scripts that can execute system commands and network operations.\n
Sanitization: No validation or sanitization is performed on the input diagram text before it is potentially read into the agent's context.

convert-mermaid