The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script ./scripts/pele fetches the pele package (version 1.6.0) from the NPM registry to a local cache directory if it's not already present. This is a standard dependency management pattern for this type of tool. It uses the --ignore-scripts flag to ensure that no arbitrary code is executed during the installation process.
[COMMAND_EXECUTION]: The wrapper script executes a Node.js process to perform the diagram processing. It handles command-line arguments and file paths provided by the user to read input and write output, following standard CLI utility patterns.
[DYNAMIC_EXECUTION]: The bundled Node.js logic uses dynamic import() to load the pele library from the local cache. The import path is constructed from environment variables set by the bash wrapper, ensuring it loads the pinned version from the expected location.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external diagram data, which represents an attack surface for indirect injection. However, the skill explicitly documents and provides security flags (--no-links, --no-images) to strip potentially harmful external references (like tracking beacons or malicious links) when rendering diagrams from untrusted sources, demonstrating a secure-by-design approach.

pele