The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local codebase, including source files, git history, and documentation, and interpolates this content into a generated HTML report.
Ingestion points: Local repository files, git log output, GLOSSARY.md, and ADR documents are processed to identify architectural friction.
Boundary markers: The instructions do not specify delimiters or sanitization steps to isolate codebase content within the HTML report.
Capability inventory: The skill has the ability to read files, execute shell commands, write to the system's temporary directory, and trigger the OS to open files in a browser.
Sanitization: There is no evidence of HTML escaping or validation of data extracted from the codebase before it is rendered in the report.
[COMMAND_EXECUTION]: The skill utilizes shell commands to facilitate its workflow.
Repository Analysis: Executes git log --oneline to identify frequently changed files and hotspots.
Report Viewing: Automatically opens the generated HTML report using xdg-open (Linux), open (macOS), or start (Windows).
[DYNAMIC_EXECUTION]: The HTML report template utilizes the Mermaid.js library to render diagrams dynamically from agent-generated text. The template explicitly configures Mermaid with securityLevel: "loose", which allows the rendering of HTML and potentially scripts embedded within the diagram definitions if the AI copies malicious patterns from the codebase.
[EXTERNAL_DOWNLOADS]: The generated report fetches layout and diagramming assets from well-known external sources, including cdn.tailwindcss.com for styling and cdn.jsdelivr.net for the Mermaid diagramming library.

improve-codebase-architecture