The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell and Node.js scripts (scripts/start-server.sh, scripts/server.cjs) to launch a visual brainstorming companion. These scripts are used to host a local web server for rendering mockups and do not execute remote or untrusted code.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided ideas and briefs to generate implementation plans and HTML artifacts. This ingestion surface is managed through rigorous self-review instructions that require the agent to scan for placeholders, contradictions, and implementation leakage before presenting the plan for user approval.
[SAFE]: The local WebSocket and HTTP server implemented in scripts/server.cjs uses only built-in Node.js modules (http, crypto, fs, path). It follows security best practices, such as binding to the loopback interface (127.0.0.1) by default and using path.basename to prevent directory traversal when serving files from the local session directory.

spark