The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses git log --oneline to explore codebase hot spots. It also invokes platform-specific commands—xdg-open (Linux), open (macOS), and start (Windows)—to automatically open the generated HTML architectural report in the user's browser.
[EXTERNAL_DOWNLOADS]: The HTML report template defined in HTML-REPORT.md fetches the Tailwind CSS framework from cdn.tailwindcss.com and the Mermaid.js library from cdn.jsdelivr.net. These are well-known content delivery networks used for layout and diagram rendering.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect injection because it processes untrusted codebase data and renders it into a local HTML file.
Ingestion points: Codebase files, git commit messages, GLOSSARY.md, and Architecture Decision Records (ADRs) are read to populate the report.
Boundary markers: No explicit boundary markers or isolation instructions are used when interpolating codebase content into the report scaffold.
Capability inventory: The skill can write files to the OS temporary directory and trigger the execution of the default web browser to view those files.
Sanitization: The skill lacks explicit sanitization of codebase content before rendering. The Mermaid.js configuration in HTML-REPORT.md is set to securityLevel: "loose", which permits the rendering of HTML tags within diagrams. This configuration could allow malicious content embedded in the codebase (e.g., in filenames or comments) to execute scripts (XSS) or spoof information when the user views the report.

improve-codebase-architecture