The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell scripts (start-server.sh, stop-server.sh) to manage a local Node.js server for visual mockups. It also executes Git commands (git add, git commit) to document and track the design process as intended.
[INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it incorporates data from the project codebase and external browser events into its reasoning and documentation.
Ingestion points: The skill reads existing project files, recent commits, and the $STATE_DIR/events file, which records user interactions (clicks/selections) from the visual companion.
Boundary markers: The process includes a mandatory user review gate after the design is written, and specific instructions to present designs in sections for incremental validation.
Capability inventory: The skill can write to the file system (spec documents and HTML mockups) and perform Git commits.
Sanitization: The Node.js server (server.cjs) uses path.basename() when serving files to prevent path traversal attacks. The skill relies on the user to review the generated spec document before it is finalized.

brainstorming