The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell scripts (start-server.sh, stop-server.sh) and node to manage the lifecycle of a local companion server. These commands are used to initialize directories, manage process IDs, and run the server component.
[DYNAMIC_EXECUTION]: The Node.js server utilizes child_process.exec and child_process.execFile to launch the user's web browser. It selects the appropriate launcher based on the operating system (e.g., open on macOS, xdg-open on Linux, or rundll32.exe on Windows) to display the companion interface.
[INDIRECT_PROMPT_INJECTION]: The skill captures user interactions (such as clicks on A/B choices) from the browser and feeds this data back into the agent's context, creating a potential attack surface for indirect injection via manipulated interaction data.
Ingestion points: Interaction events are read from the $STATE_DIR/events file as part of the operational loop defined in SKILL.md.
Boundary markers: There are no explicit boundary markers or instructions provided to the agent to treat browser-originating text as untrusted data.
Capability inventory: The skill can execute shell scripts and write arbitrary HTML content to specific session directories.
Sanitization: The server validates that incoming WebSocket messages are well-formed JSON before appending them to the event log, providing basic structured data validation.

visual-companion