The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses platform-specific commands (xdg-open on Linux, open on macOS, and start on Windows) to open the generated HTML architectural review in the user's default browser.
[EXTERNAL_DOWNLOADS]: The generated HTML report fetches external resources from well-known services, including Tailwind CSS from cdn.tailwindcss.com and the Mermaid.js library from cdn.jsdelivr.net for rendering diagrams.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the local codebase, including source files, commit history (git log), and existing documentation (CONTEXT.md, ADRs).
Ingestion points: Codebase files, git history, and domain glossaries are read to identify architectural patterns.
Boundary markers: The instructions do not define explicit delimiters or instructions for the sub-agents to ignore potentially malicious content embedded in the scanned files.
Capability inventory: The skill possesses the ability to spawn sub-agents, write files to the system's temporary directory, and execute shell commands to display the report.
Sanitization: There is no explicit sanitization process described for codebase content before it is interpolated into the HTML report or processed by architectural sub-agents.
[DYNAMIC_EXECUTION]: The skill generates an HTML file containing scripts that execute in the user's browser environment. Specifically, it initializes the Mermaid diagramming library with securityLevel: "loose", which permits a wider range of HTML and script content within diagrams, potentially increasing the risk of cross-site scripting (XSS) if scanned code content is rendered unsafely.

improve-codebase-architecture