The Agent Skills Directory

[DYNAMIC_EXECUTION]: The main CLI entry point, bin/archify.mjs, dynamically identifies and executes renderer-specific scripts (such as render-architecture.mjs) using spawnSync. This design, which executes code from paths calculated at runtime, is a form of dynamic loading that requires verification of the script integrity.
[DATA_EXFILTRATION]: The skill performs outbound network requests in two scenarios:
The brands capture feature in renderers/shared/brand-marks.mjs allows the agent to fetch icon data from arbitrary HTTP(S) URLs. While the implementation includes checks to block private and loopback IP addresses, it still represents an outbound connection capability.
The update check mechanism in scripts/check-update.mjs connects to an external domain (tt-a1i.github.io) to retrieve manifest information.
[COMMAND_EXECUTION]: The utility bin/open-artifact.mjs invokes system commands like open, xdg-open, or powershell.exe to launch generated files in the user's browser or to preview local URLs. Although these calls are made without a shell and use argument arrays to mitigate injection, they constitute direct interaction with system-level process handlers.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process complex data structures (JSON diagrams and Mermaid syntax). There is a inherent risk that malicious instructions could be embedded within these inputs to influence the agent's behavior, particularly since the skill has the authority to write files and make network requests.

archify