The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to run npx -y thurview. This fetches and executes the 'thurview' package directly from the NPM registry, which is a well-known and standard service for Node.js development tools.
[DATA_EXFILTRATION]: The skill uses thurview publish to upload generated architecture explainers to a remote server so they can be viewed in a browser. This is the primary function of the tool for sharing documentation.
[DATA_EXFILTRATION]: The skill accesses configuration and guidance files located at ~/.thurview/THURVIEW.md or a path defined by the $THURVIEW_HOME environment variable. This involves reading files from the user's home directory to determine tool behavior.
[COMMAND_EXECUTION]: The skill performs multiple shell operations including git ls-tree and git grep to analyze the repository, as well as several thurview CLI commands (explain, publish, open, wait, export) to manage the explainer lifecycle.
[INDIRECT_PROMPT_INJECTION]: The skill creates documentation by analyzing the content of a local codebase, which is considered untrusted data. This presents a surface for indirect prompt injection if the code being explained contains malicious instructions designed to influence the agent.
Ingestion points: The agent reads the repository structure and file contents using git ls-tree and git grep to generate the review.md and map.yaml files.
Capability inventory: The agent has the capability to execute shell commands (thurview, git), write files to the local disk, and send data to a remote server via the publish command.
Boundary markers: The instructions do not specify the use of delimiters or specific warnings to prevent the agent from obeying instructions embedded within the analyzed code comments or strings.
Sanitization: There is no explicit requirement for the agent to sanitize or escape the content gathered from the codebase before interpolating it into the generated documentation.

thurview-explain