The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to use platform-specific system commands such as xdg-open, open, and start to automatically open a generated HTML file on the user's host machine.
[DYNAMIC_EXECUTION]: The skill generates an HTML file at runtime in the system's temporary directory. It explicitly instructs the agent to configure the Mermaid diagramming library with securityLevel set to 'loose', which allows the rendering of arbitrary HTML within diagrams, potentially leading to script execution if the source data is malicious.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted data from a local codebase including file contents, commit history, and metadata and incorporates this data into the generated report without explicit sanitization requirements. 1. Ingestion points: Reads arbitrary files from the user's codebase and commit history through tools like git log and automated exploration. 2. Boundary markers: None identified; there are no instructions to delimit or treat the codebase content as untrusted data within the report scaffold. 3. Capability inventory: Filesystem writes to /tmp, network access via browser CDNs, and system command execution for file opening. 4. Sanitization: Absent; the instructions do not specify sanitizing file names or code contents before they are included in the HTML report.
[EXTERNAL_DOWNLOADS]: The generated HTML report fetches the Tailwind CSS and Mermaid JS libraries from well-known public CDNs including cdn.tailwindcss.com and cdn.jsdelivr.net to provide styling and diagramming capabilities.

improve-codebase-architecture