The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to inspect the codebase and display the generated report.
Uses git log to analyze commit history for "hot spots."
Uses open, xdg-open, or start to automatically open the generated HTML report in the user's default browser.
[EXTERNAL_DOWNLOADS]: The generated HTML report fetches resources from well-known external CDNs.
Loads Tailwind CSS from https://cdn.tailwindcss.com for styling.
Loads the Mermaid diagram library from https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs for rendering architectural diagrams.
[DYNAMIC_EXECUTION]: The skill dynamically constructs an HTML file at runtime and triggers a system action to view it.
Resolves the system temporary directory and writes a timestamped HTML file (architecture-review-<timestamp>.html).
The HTML report configuration includes securityLevel: "loose" for Mermaid diagrams, which permits the rendering of HTML content within diagrams.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebase content which could influence the agent's output or the final report.
Ingestion points: Reads codebase files, git history, and domain metadata (CONTEXT.md, ADRs) using a subagent.
Boundary markers: None specified for the codebase scanning process.
Capability inventory: Can write files to the temporary directory and execute system commands to open files.
Sanitization: No explicit sanitization of codebase content is mentioned before it is interpolated into the HTML report or Mermaid diagrams. This could lead to Cross-Site Scripting (XSS) if malicious content from the codebase is rendered in the browser when the report is opened.

improve-codebase-architecture