The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains a shell command injection vulnerability in Step 4. The instructions direct the agent to execute mmdc and npx using a <diagram-name> that is derived from user-provided $ARGUMENTS in Step 3. If the agent is successfully persuaded to use a filename containing shell metacharacters (e.g., ;, `, or $(...)), it will lead to arbitrary code execution on the host system when verifying the Mermaid syntax.
[EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute the @mermaid-js/mermaid-cli package from the official npm registry. While this is a well-known service and a legitimate tool for the skill's purpose, it involves downloading and executing external code at runtime.
[PROMPT_INJECTION]: The skill processes untrusted user data via $ARGUMENTS in Step 1 without any structural isolation or boundary markers. This exposes the agent to indirect prompt injection attacks where a user can provide instructions that override the skill's logic.
Ingestion points: User-provided requirements are parsed directly from $ARGUMENTS in Step 1.
Boundary markers: None present; there are no delimiters (like XML tags) or instructions to ignore embedded commands within the input.
Capability inventory: The skill has access to the Bash tool, as well as Read, Write, and Edit file operations.
Sanitization: There is no explicit validation or sanitization logic to filter the input or the derived filenames before they are passed to shell commands.

mermaid-diagram