The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses spawnSync to execute the draw.io Desktop CLI for diagram export and rendering. It also executes local Python and Node.js scripts for validation and searching, and can open browser instances to preview diagrams.
[EXTERNAL_DOWNLOADS]: The skill fetches public SVG icons from public registries and proposes tool installation using the nix package manager. These operations target well-known services and include user approval checkpoints.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted diagram files and architecture sources.
Ingestion points: Processes .drawio XML files and external architecture specifications.
Boundary markers: Implements a strict review workflow that is read-only and requires explicit transitions to mutating workflows.
Capability inventory: Scripts can perform file writes, subprocess execution, and network lookups for icons.
Sanitization: Employs preflight-drawio-xml.mjs to reject forbidden XML tags (comments, DOCTYPEs) and validate_drawio.py to inspect embedded SVGs for active content like scripts.
[DYNAMIC_EXECUTION]: The open-drawio-url.mjs script dynamically creates temporary Windows shortcut files (.url) to facilitate safe browser opening, which is a standard integration pattern.

drawio-diagrams