The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local codebase, including source files, ADRs, and git commit history, to perform its analysis.
Ingestion points: Codebase walk, git log --oneline, ZJ-CONTEXT.md, and docs/zj-adr/ files.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are specified when the agent reads external files.
Capability inventory: The skill writes to the filesystem (temporary directory) and executes system commands to open the resulting HTML report.
Sanitization: There is no explicit instruction to sanitize or escape data before it is incorporated into the generated HTML report.
[DYNAMIC_EXECUTION]: The generated HTML report utilizes the Mermaid diagramming library with a security configuration that increases risk.
Evidence: The scaffold in HTML-REPORT.md initializes Mermaid with securityLevel: "loose".
Risk: This setting allows HTML tags and potential script execution within diagrams. If an attacker-controlled codebase contains malicious filenames or code comments that are rendered into a diagram, it could result in a Cross-Site Scripting (XSS) attack when the user opens the report.
[COMMAND_EXECUTION]: The skill uses shell commands to open the generated report on the host system.
Evidence: The skill uses xdg-open, open, or start to open the file path generated in the temporary directory.
[EXTERNAL_DOWNLOADS]: The generated report fetches external libraries from well-known content delivery networks (CDNs).
Evidence: The report loads Tailwind CSS and Mermaid JS via https://cdn.tailwindcss.com and https://cdn.jsdelivr.net respectively.

zj-improve-codebase-architecture