The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected. The skill follows best practices for AI agent extensions, including explicit role definitions and clear operational boundaries.
[COMMAND_EXECUTION]: The skill includes shell scripts to manage a local Node.js server (scripts/start-server.sh, scripts/stop-server.sh). These are used to host the 'Visual Companion' browser interface for viewing design mockups. The execution is properly scoped to the local development environment and provides stability through parent-process monitoring and idle timeouts.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied feature briefs and project documentation to generate implementation plans, which is a standard surface for indirect prompt injection in planning tools. * Ingestion points: Processes the idea-or-feature-brief argument and reads project files such as AGENTS.md and code_map.md. * Boundary markers: The skill utilizes explicit <HARD-GATE> instructions and internal self-review checklists to ensure the agent does not modify production code or proceed to execution without separate user approval. * Capability inventory: The agent can write Markdown and HTML files to specific project directories (.plannings/, .spark/) and manage the lifecycle of a local Node.js companion server. * Sanitization: The visual companion server in scripts/server.cjs implements security best practices by using path.basename() to prevent directory traversal attacks when serving session-specific files.

spark