The Agent Skills Directory

[COMMAND_EXECUTION]: The skill initiates a local Node.js server via a shell script (scripts/start-server.sh) to support its 'Visual Companion' browser interface. This is used to render diagrams and mockups written by the agent.
[SAFE]: The server implementation in scripts/server.cjs follows security best practices for local development tools. It binds to the loopback address (127.0.0.1) by default, preventing external network access. It also implements a 30-minute idle timeout and uses parent-process monitoring (via OWNER_PID) to ensure the server automatically shuts down when the agent session ends.
[SAFE]: File access within the local server is restricted. The static file server component uses path sanitization (path.basename) to prevent directory traversal attacks when serving assets from the temporary session directory.
[SAFE]: No external dependencies, remote downloads, or exfiltration patterns were detected. The Node.js server uses only built-in modules (crypto, http, fs, path).

brainstorming