The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains Python scripts (split-excalidraw-library.py, add-icon-to-diagram.py, and add-arrow.py) designed to be run locally by the agent or user to manage Excalidraw assets. These scripts use only Python standard libraries (json, pathlib, re, uuid) to perform file operations and do not make network requests or execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes user descriptions and reads existing Excalidraw diagram and library files.
Ingestion points: Natural language requests from the user and content from local .excalidraw and .excalidrawlib files.
Boundary markers: The agent is instructed to follow a strict JSON schema and visual templates.
Capability inventory: The skill is limited to local file system read/write operations for diagram generation and does not have access to sensitive credentials or network resources.
Sanitization: The split-excalidraw-library.py script includes logic to sanitize filenames generated from icon names to prevent path traversal or invalid file naming.

excalidraw-studio