The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell scripts (start-server.sh) and a custom Node.js web server (server.cjs) to facilitate the Visual Companion feature. The server binds to the local loopback address (127.0.0.1) by default and includes activity tracking to shut itself down after 30 minutes of inactivity.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze the user's project context by reading files, documentation, and recent commits. Ingestion points: local codebase files. Boundary markers: the agent is instructed to create a spec document for explicit user approval. Capability inventory: shell script execution and file writing to the docs/ directory. Sanitization: the skill includes a dedicated spec reviewer prompt to validate generated requirements for consistency and completeness.
[DYNAMIC_EXECUTION]: The agent dynamically generates HTML fragments and UI components that are rendered in the user's browser. These fragments are wrapped in a predefined frame template provided by the skill scripts to maintain a consistent and constrained execution environment.
[INDIRECT_PROMPT_INJECTION]: The agent reads user interaction data from a local state file generated by browser events. Ingestion points: state_dir/events file. Boundary markers: the skill instructions prioritize the user's terminal responses as the primary feedback channel. Capability inventory: WebSocket communication and file reading. Sanitization: interaction data is parsed as structured JSON events and merged with manual user feedback.

brainstorming