The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to use npx -y mcp-excalidraw-server, which fetches the package from the official NPM registry at runtime. While the NPM registry is a well-known service, the skill relies on a package that is not from a pre-verified trusted organization.
[REMOTE_CODE_EXECUTION]: The use of npx to download and run code from a public registry represents a remote code execution vector, as the package content is managed externally.
[COMMAND_EXECUTION]: The skill uses various shell commands to interact with the Excalidraw server and includes an install-skill command that can write files to directories chosen by the agent, potentially modifying the local environment.
[DATA_EXFILTRATION]: The share command performs an encrypted upload of the canvas state to excalidraw.com. Although this is the official sharing service for the tool, it involves sending user-generated diagram data to an external network endpoint.
[INDIRECT_PROMPT_INJECTION]: The skill parses external data formats, creating a potential surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters via mermaid conversion (stdin/file), add (JSON elements), and import (.excalidraw/.md files).
Boundary markers: There are no explicit instructions or delimiters used to prevent the agent from following instructions embedded within the diagrams or Mermaid code.
Capability inventory: The skill can execute shell commands via npx, write to the local filesystem via export, and perform network uploads via share.
Sanitization: The instructions do not specify any validation or sanitization routines for the ingested Mermaid diagrams or JSON element structures.

excalidraw-skill