The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebase data which could contain malicious instructions designed to influence agent behavior.
Ingestion points: Reads files, git logs, and ADRs from the local repository (SKILL.md, Step 1).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are defined for the sub-agent exploration or the data placed into the HTML report.
Capability inventory: Executes shell commands (git log, open), writes to temp directories, and updates project documentation (CONTEXT.md, ADRs) via tools.
Sanitization: No explicit sanitization or filtering is performed on data retrieved from the codebase before it is included in the HTML report or used in tool calls.
[DYNAMIC_EXECUTION]: The skill generates an HTML report that initializes the Mermaid library with the security level set to 'loose'.
Evidence: The scaffold in references/HTML-REPORT.md explicitly sets securityLevel: 'loose'.
Risk: This disables Mermaid's internal sanitization, allowing potentially malicious scripts or click events embedded in codebase identifiers or content to execute when the user opens the generated report.
[EXTERNAL_DOWNLOADS]: The generated HTML report fetches styling and diagramming libraries from external CDNs.
Evidence: Fetches Tailwind CSS from cdn.tailwindcss.com and Mermaid JS from cdn.jsdelivr.net.
Status: These are well-known services used for legitimate styling and rendering purposes.
[COMMAND_EXECUTION]: The skill uses system commands for repository analysis and user interaction.
Evidence: Executes git log --oneline to find codebase hotspots and uses platform-specific commands like xdg-open, open, or start to display the HTML report to the user.

improve-codebase-architecture