The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses a Python script (scripts/download_diagram.py) to download PNG and SVG files from remote URLs provided by the EdrawMax API and save them to the local filesystem.
[COMMAND_EXECUTION]: The download utility scripts/download_diagram.py explicitly disables SSL certificate verification (ssl.CERT_NONE) and hostname checking (check_hostname = False). This is a security best-practice violation that allows an attacker to intercept the connection and potentially provide malicious files instead of the intended diagrams (Man-in-the-Middle attack).
[COMMAND_EXECUTION]: The script takes an --output-dir argument from the agent and uses os.makedirs(..., exist_ok=True) and open(..., 'wb') to write files. This allows the agent to write files to any directory on the local system for which the process has write permissions.
[SAFE]: The API endpoints utilized by the skill (api.edrawmax.cn) belong to the verified vendor (Wondershare EdrawMax) and are used for their intended purpose of diagram generation.

edrawmax-diagram