The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes external data from Excalidraw icon libraries to enhance diagrams.
Ingestion points: The agent is instructed to read libraries/<library-name>/reference.md and individual icon JSON files located in the icons/ subdirectory. These files are typically downloaded by the user from external sources like the Excalidraw library marketplace.
Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard potential natural language commands embedded within the icon metadata or the reference documentation.
Capability inventory: Across the skill, the agent can execute Python scripts (add-icon-to-diagram.py, add-arrow.py, split-excalidraw-library.py) which possess file-write and directory-creation capabilities on the local filesystem.
Sanitization: There is no evidence of sanitization or validation of the content within the icon JSON files before they are merged into the user's diagram file or processed by the agent's logic.
[COMMAND_EXECUTION]: The skill's primary workflow involves the agent executing local Python scripts to perform diagram edits. These scripts take file paths and element names as command-line arguments.
Scripts: scripts/add-arrow.py, scripts/add-icon-to-diagram.py, and scripts/split-excalidraw-library.py.
Evidence: The scripts use sys.argv to ingest parameters such as diagram_path and library_path, which are used directly with pathlib.Path for file operations including rename, read, and write. Without strict validation of these paths by the agent, there is a risk of path traversal or accidental manipulation of sensitive local files if the agent is misled regarding the target diagram's location.

excalidraw-diagram-generator