The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/export.py script executes external binaries including resvg and Google Chrome using subprocess.run to perform image rendering. These calls use list-based argument passing, which is a secure practice to prevent shell injection, and are necessary for the skill's stated purpose.
[EXTERNAL_DOWNLOADS]: The scripts/setup.sh script installs standard Python packages (fonttools, brotli) via pip and the resvg utility via Homebrew. These operations target official package registries and are documented for the user.
[DATA_EXFILTRATION]: The skill sends generated diagram data to https://kroki.io via HTTP POST requests in scripts/export.py. This is a well-known service used to render Excalidraw JSON into SVG format, and the data transfer is the intended core functionality of the skill.

excalidraw-export