The Agent Skills Directory

[SAFE]: The skill implements robust defenses against XML External Entity (XXE) attacks through scripts/preflight-drawio-xml.mjs and scripts/validate_drawio.py. These tools perform strict validation on all incoming diagram XML, including compressed payloads, specifically rejecting DOCTYPE declarations and unauthorized processing instructions.
[COMMAND_EXECUTION]: The skill uses utility scripts to interface with system tools like the Draw.io Desktop CLI and browser openers. These interactions are performed using spawnSync with argument arrays, which is a secure pattern that prevents shell command injection.
[SAFE]: The skill addresses the potential surface for indirect prompt injection by processing external XML files. While it lacks explicit boundary markers in the XML structure, it mitigates risk by requiring mandatory pre-processing through the aforementioned validation scripts before any data influences agent behavior or system commands.
[SAFE]: The skill includes explicit security and privacy policies in SKILL.md and references/toolset-setup.md. It forbids the agent from fetching remote icons, downloading shape indexes, or installing tools without direct user approval, and it warns against including sensitive data in diagrams that may be processed by hosted services.

drawio-diagrams