The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts render.mjs, batch.mjs, and themes.mjs utilize child_process.execSync to invoke npm install. This occurs as a self-healing mechanism to ensure the required beautiful-mermaid library is available locally. The execution is targeted to the skill's own root directory and uses hardcoded arguments.
[EXTERNAL_DOWNLOADS]: The skill is configured to download the beautiful-mermaid package from the official NPM registry if missing. This is a standard dependency management practice and targets a well-known service.
[REMOTE_CODE_EXECUTION]: The renderer scripts use dynamic import() to load the beautiful-mermaid package from a path computed at runtime (the local node_modules directory). While dynamic loading can be a risk, in this context it is restricted to loading the skill's own verified dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill defines a clear ingestion surface for untrusted data by processing user-provided Mermaid source code. It includes specific validation and error-reporting instructions in SKILL.md to ensure the agent verifies output integrity, which is a recommended safeguard for data-processing skills.

pretty-mermaid