The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/validate.js utility uses new Function() to evaluate the scene.js file. Since scene.js is generated by the AI agent based on user-provided architecture descriptions, this constitutes dynamic execution of locally-generated code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input such as codebases, documentation, and user descriptions to generate visual diagrams, creating a surface for injection.
Ingestion points: User-supplied architecture descriptions, architecture documentation files, and codebase files explored by the agent in SKILL.md Step 1.
Boundary markers: Absent; the skill instructions do not require the agent to wrap user data in protective delimiters within the generated scene.js data constants.
Capability inventory: File system write operations in scripts/build.js and dynamic JavaScript execution in scripts/validate.js.
Sanitization: The HTML viewer template (assets/template.html) includes an escapeHtml function to sanitize component descriptions, although other diagram text fields (labels, titles) may not be explicitly sanitized.
[PERSISTENCE_MECHANISMS]: The bin/cli.js installer script facilitates the persistence of the skill by creating symlinks or copying the skill payload into global or project-specific agent directories (e.g., ~/.claude/skills).
[COMMAND_EXECUTION]: The skill workflow requires the agent to execute shell commands, specifically node scripts/validate.js and node scripts/build.js, to process the generated scene data and assemble the final HTML artifact.
[EXTERNAL_DOWNLOADS]: The README.md encourages the use of npx commands (e.g., npx draw-architecture) to install the skill. These commands fetch the package from the npm registry, which is a standard distribution mechanism for this vendor.

architecture-canvas