The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches diagram renders from the Kroki API (kroki.io). Kroki is an established well-known service for multi-engine diagram rendering.
[DATA_EXFILTRATION]: Transmits user-provided PlantUML source code to the external Kroki API to perform the rendering. The skill includes explicit transparency regarding this behavior in its documentation (references/rendering-backends.md), advising the use of local rendering instances for sensitive or proprietary content.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from source code files and Markdown documents to extract diagram definitions. This represents a potential surface for indirect prompt injection if the processed files contain malicious instructions.
Ingestion points: Existing source code files (described in references/from-source-code.md) and Markdown files (described in references/markdown-embed.md).
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested data.
Capability inventory: The skill utilizes network communication via curl to external APIs and performs local file writes (.puml, .png, .svg) as seen in SKILL.md.
Sanitization: There is no mention of escaping or filtering logic for the content extracted from external files before processing.

plantuml-skill