The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the codebase, including source files, documentation, and git history, to generate its architectural review.
Ingestion points: Codebase files and git logs are read in the Explore phase in SKILL.md.
Boundary markers: None present to distinguish codebase content from instructions.
Capability inventory: The skill can write files to the temporary directory, open them in a browser, and modify project documentation (CONTEXT.md).
Sanitization: No explicit sanitization or escaping of codebase content is mentioned before it is interpolated into the generated HTML report.
[EXTERNAL_DOWNLOADS]: Fetches layout and styling resources from Tailwind's official CDN and the Mermaid diagramming library from JSDelivr's repository.
[COMMAND_EXECUTION]: Utilizes system utilities to explore the project environment and provide a user interface.
Executes git log to identify active development areas.
Resolves system temporary directories via $TMPDIR, /tmp, or %TEMP%.
Uses xdg-open, open, or start to automatically launch the generated report in the user's default browser.
[DYNAMIC_EXECUTION]: Generates a dynamic HTML report that loads external JavaScript. The Mermaid diagramming library is initialized with securityLevel: "loose" in HTML-REPORT.md, which enables HTML rendering and script support within diagrams. This configuration could lead to cross-site scripting (XSS) if the agent includes malicious strings sourced from the codebase within diagram labels.

improve-codebase-architecture