The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses platform-specific system commands (xdg-open, open, start) to automatically open a generated HTML report located in the operating system's temporary directory.
[EXTERNAL_DOWNLOADS]: The generated HTML report fetches CSS and JavaScript libraries from well-known services, specifically Tailwind CSS via cdn.tailwindcss.com and Mermaid.js via the jsDelivr CDN.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads untrusted data from the local codebase, including CONTEXT.md, architecture decision records (ADRs) in docs/adr/, and various source code modules.
Boundary markers: There are no explicit boundary markers or instructions to isolate or treat ingested codebase content as potentially malicious during the report generation phase.
Capability inventory: The skill can write files to the temporary directory and execute commands to open those files in the default web browser.
Sanitization: The skill lacks explicit sanitization or escaping protocols to handle codebase content before it is interpolated into the HTML report template.
[DYNAMIC_EXECUTION]: The HTML report template (HTML-REPORT.md) configures the Mermaid diagramming library with securityLevel: "loose". This configuration allows for the rendering of HTML and the execution of scripts within diagrams. Since the diagram content is derived from untrusted codebase data, this creates a potential surface for local cross-site scripting (XSS) when the user views the report.

improve-codebase-architecture