The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill identifies a dependency on the drawio-ai-kit located at github:sparklabx/drawio-ai-kit. It correctly provides instructions for manual global installation via npm, ensuring the environment is not modified automatically by the agent.
[COMMAND_EXECUTION]: The skill relies on executing the drawio-ai CLI for multiple tasks, including path resolution via drawio-ai root, fetching workflow instructions, and retrieving architectural principles.
[REMOTE_CODE_EXECUTION]: The skill utilizes a scaffolding command to generate a local execution script (build.mjs) which is then executed using node. This represents a dynamic code generation and execution pattern necessary for the skill's primary function.
[PROMPT_INJECTION]: The prompt template designed for subagents contains a directive to ignore other skills (“Do NOT invoke any drawio skill”). This is used to constrain the agent to the specific provided workflow rather than bypassing safety protocols.
[PROMPT_INJECTION]: The skill processes external user input to build diagrams, representing a potential surface for indirect injection.
Ingestion points: User diagram requests are passed into the drawio-ai scaffold and subsequent node build.mjs workflow in SKILL.md.
Boundary markers: The subagent prompt uses structured return blocks (e.g., DRAWIO:, VALIDATE:) to delimit agent output.
Capability inventory: The skill utilizes shell command execution, file system writes, and local script execution.
Sanitization: No explicit sanitization or escaping of the user's diagram request is described before it is processed by the scaffolding tool.

drawio-bpmn