The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to facilitate codebase analysis and display results. Specifically, it executes git log --oneline to identify frequently changed files and uses platform-specific commands such as xdg-open, open, or start to launch the generated HTML report in the user's browser.
[EXTERNAL_DOWNLOADS]: The HTML report scaffold fetches resources from well-known services at runtime. It loads the Tailwind CSS framework from cdn.tailwindcss.com and the Mermaid library from cdn.jsdelivr.net to handle layout and diagram rendering.
[DYNAMIC_EXECUTION]: The skill generates a temporary HTML file containing JavaScript and CSS from templates and then instructs the operating system to execute it via the default web browser.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes untrusted data from the local codebase to generate an external report.
Ingestion points: The sub-agent walks the codebase and reads various files to identify architectural patterns and friction (SKILL.md).
Boundary markers: No specific isolation or sanitization steps are documented for codebase content before it is interpolated into the HTML report.
Capability inventory: The skill has the ability to write files to the system's temporary directory and trigger the system's file opener/browser (SKILL.md).
Sanitization: The Mermaid diagram initialization in the report template uses securityLevel: "loose" (HTML-REPORT.md). This configuration allows the execution of HTML and scripts within diagrams, which could be exploited if malicious strings from the codebase are included in a generated diagram.

improve-codebase-architecture