The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the local codebase and renders it into a visualization report. * Ingestion points: Source code, file paths, and git commit history retrieved via git log. * Boundary markers: No delimiters or warnings are specified for sanitizing codebase content before it is included in diagrams. * Capability inventory: Writing to the temporary directory and launching a browser to open the file. * Sanitization: The Mermaid.js configuration in HTML-REPORT.md uses securityLevel: "loose", which permits script execution within diagrams, creating a surface for XSS if malicious patterns are extracted from the codebase.
[COMMAND_EXECUTION]: Uses system commands to perform its primary function. * Executes git log --oneline to identify codebase hot spots. * Uses xdg-open, open, or start to show the generated HTML report to the user.
[EXTERNAL_DOWNLOADS]: Fetches configuration and styling assets from well-known technology services. * Loads Tailwind CSS from the official CDN at https://cdn.tailwindcss.com. * Loads the Mermaid.js library from the jsdelivr.net public registry.
[DYNAMIC_EXECUTION]: Dynamically generates an HTML and JavaScript-based report. * The manual override of the Mermaid.js security level to a less restrictive mode is a concern when processing untrusted local data as it allows diagram components to execute code.

improve-codebase-architecture