The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local commands to analyze the project and present findings.
Evidence: Uses git log --oneline in SKILL.md to identify codebase hot spots.
Evidence: Executes xdg-open, open, or start in SKILL.md to automatically launch the generated architectural report in the user's default browser.
[EXTERNAL_DOWNLOADS]: The generated HTML report fetches external resources from well-known services.
Evidence: HTML-REPORT.md includes <script src="https://cdn.tailwindcss.com"></script> for styling.
Evidence: HTML-REPORT.md imports mermaid.esm.min.mjs from cdn.jsdelivr.net for diagram rendering.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect injection via processed codebase data.
Ingestion points: SKILL.md instructs the agent to read CONTEXT.md, docs/adr/, git logs, and various source files across the repository.
Boundary markers: No explicit boundary markers or sanitization logic is defined for the HTML report generation.
Capability inventory: The skill can write files to the temp directory and execute shell commands to open them.
Sanitization: Not present. HTML-REPORT.md explicitly configures the Mermaid diagram engine with securityLevel: "loose", which increases the risk of cross-site scripting (XSS) if malicious code strings are parsed from the repository and rendered into the report's diagrams.

improve-codebase-architecture