The Agent Skills Directory

[Unsafe XML Parsing] (MEDIUM): The validation script scripts/validate_drawio.py uses the xml.etree.ElementTree library to process XML data.
Evidence: The script imports xml.etree.ElementTree and calls ET.fromstring(content) on the contents of a .drawio file in the validate_drawio function.
Risk: The default ElementTree parser is not secure against maliciously constructed data. Specifically, it is vulnerable to XML entity expansion attacks (such as the "Billion Laughs" attack), which can lead to a Denial of Service (DoS) by exhausting system memory. While modern Python versions mitigate some external entity risks, the parser still lacks the necessary resource constraints for safely handling untrusted XML input.

drawio-generator