The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses git log --oneline to analyze commit history for code hotspots. It also utilizes OS-native commands (xdg-open, open, start) to launch the generated HTML architecture report in the user's default browser.
[EXTERNAL_DOWNLOADS]: The generated HTML reports include script and style references to Tailwind CSS and the Mermaid diagramming library via well-known content delivery networks (CDNs).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from the codebase being analyzed.
Ingestion points: Reads GLOSSARY.md, ADR documentation, source code files, and git logs.
Boundary markers: Instructions do not provide specific delimiters or ignore-directives to prevent the agent from obeying instructions embedded in the analyzed code.
Capability inventory: The agent can write HTML reports to temporary system directories, update the project's GLOSSARY.md, and create new ADR (Architecture Decision Record) files.
Sanitization: There is no mention of sanitizing or escaping content from the codebase before it is used in report generation or file updates.
[DYNAMIC_EXECUTION]: The HTML report scaffold in HTML-REPORT.md configures the Mermaid library with securityLevel: "loose". This setting allows HTML tags to be rendered within diagrams, which could potentially execute scripts (XSS) if the source code or file names being visualized contain malicious HTML payloads.

improve-codebase-architecture