The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Node.js runtime to execute internal validation and rendering scripts. These scripts (scripts/validate-wavejson.mjs and scripts/render-wavedrom.mjs) are invoked via child_process.spawnSync with explicitly constructed argument arrays, which effectively mitigates the risk of shell command injection.
[PERSISTENCE]: The skill provides a registration helper (scripts/register-mcp.mjs) designed to integrate the skill's MCP server with agent platforms like Codex and Claude Code. This script modifies external agent configuration files to persist the tool's availability, which is the documented and intended primary purpose of the registration utility.
[DYNAMIC_EXECUTION]: The rendering tool can generate self-contained HTML files for offline use. These files embed browser-side bundles of the wavedrom and json5 libraries along with the diagram source. The implementation uses sanitization functions like escapeHtml and safeInlineScript to safely interpolate data into the HTML template.
[INDIRECT_PROMPT_INJECTION]: The skill's tools ingest WaveJSON/JSON5 data provided by the agent. While ingesting untrusted data represents an attack surface, the skill utilizes a deterministic linting and validation layer before passing the data to the official WaveDrom rendering engine, minimizing the possibility of malicious instructions within the data influencing agent behavior.

wavedrom-gen