The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides serve-live.sh, which executes a Python script to start a web server. This script is intended to facilitate live editing of HTML files by accepting POST requests and writing the content back to the local file system.
[REMOTE_CODE_EXECUTION]: The serve-live.py script implements a POST /save endpoint. This endpoint accepts a JSON payload containing a markdown patch and uses regular expressions to find and replace content within index.html and overview.html. While the logic is constrained to specific HTML blocks, the ability for a local web server to perform unauthenticated writes to the file system based on network input is a significant capability that could be abused if the local environment is shared or the user is tricked into visiting a malicious site that makes cross-origin requests to the local port.
[SAFE]: The JavaScript snippets provided (references/js-card.html and references/js-slide.html) are designed to enable contentEditable on specific leaf elements. They contain logic to preserve inline tags and sync changes back to the server or clipboard. These scripts do not perform malicious network operations or access sensitive local data beyond the files being edited.

hyperframes-overview-edit