The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes scripts (render.mjs, batch.mjs) that use execSync to invoke the Mermaid CLI (mmdc) and other rendering utilities. These commands are necessary for the skill's primary function and use path quoting and sanitization logic to handle arguments.
[EXTERNAL_DOWNLOADS]: The setup.sh script automates the installation of necessary Node.js packages (@mermaid-js/mermaid-cli, beautiful-mermaid, puppeteer) from the NPM registry and downloads the Chromium browser. These are standard dependencies for the tasks performed by the skill.
[DYNAMIC_EXECUTION]: Several scripts use dynamic imports to load libraries from a managed dependency folder. The rendering process also involves generating temporary HTML files to execute Mermaid's rendering logic within a sandboxed Puppeteer browser instance.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Mermaid code, which is a common surface for indirect prompt injection. The skill mitigates this by providing a validation tool (validate.mjs) and operating within the constraints of the Mermaid rendering engine.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill retrieves icon packs and libraries from well-known and trusted content delivery networks, including unpkg.com and jsdelivr.net, purely for rendering purposes.

mermaid-studio