The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill generates an HTML report that loads dependencies from well-known and trusted services.
Fetches Tailwind CSS from the official Tailwind CDN for styling.
Fetches the Mermaid.js library from the JSDelivr content delivery network to render architectural diagrams.
[COMMAND_EXECUTION]: The skill uses standard shell commands to facilitate the architectural review process.
Executes git log --oneline to identify hot spots in the codebase history.
Uses platform-specific commands (xdg-open, open, or start) to automatically display the generated report to the user.
[PROMPT_INJECTION]: The skill processes untrusted codebase data, which presents a surface for indirect prompt injection.
Ingestion points: The agent scans project files, commit history, CONTEXT.md, and ADRs in the docs/adr/ directory.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands when interpolating extracted codebase content into the report or sub-agent prompts.
Capability inventory: The skill can write files to the system temporary directory, execute shell commands, and invoke additional skills (/grilling, /domain-modeling, /codebase-design).
Sanitization: The instructions do not specify sanitization of codebase content. Notably, the Mermaid configuration in the report uses securityLevel: "loose", which allows the rendering of HTML in labels and could potentially be exploited if a malicious actor places specially crafted Mermaid syntax in code comments that are subsequently rendered in the report.

improve-codebase-architecture