The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command to convert SVG diagrams into PNG files using a local script (scripts/main.ts). The command is constructed using a file path derived from a user-provided topic name, which introduces a potential for command injection if the input is not sanitized before the shell call.
[EXTERNAL_DOWNLOADS]: The diagram templates include an @import rule for Google Fonts (fonts.googleapis.com). This is a well-known and trusted external service and is used here in a standard manner for font loading.
[PROMPT_INJECTION]: The skill processes user-supplied text and file uploads to generate visualizations. It lacks explicit boundary markers or sanitization instructions for this data. Ingestion points include user requests and file uploads in SKILL.md. Boundary markers are absent. Capability inventory includes file system writes and subprocess execution across SKILL.md and scripts/main.ts. Sanitization of input content is not explicitly implemented.

baoyu-diagram