The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Node.js child process utilities (spawn, execSync, execFileSync) across multiple scripts (e.g., live.mjs, live-server.mjs, live-poll.mjs) to manage background helper servers and execute sub-scripts for file manipulation.
[COMMAND_EXECUTION]: The pin.mjs script creates new skill definitions in the agent's harness configuration directories (e.g., .claude/skills, .cursor/skills), allowing the skill to persist standalone tools and modify the agent's available capability set.
[REMOTE_CODE_EXECUTION]: The live iteration mode injects a client-side JavaScript file (live.js) into the project's HTML files. This script communicates with a local server to trigger file edits and design variations based on browser-side events.
[EXTERNAL_DOWNLOADS]: A minified UMD version of the modern-screenshot library is vendored within the skill (modern-screenshot.umd.js) and served to the user's browser via the local helper server for capturing UI snapshots.
[DATA_EXFILTRATION]: The local helper server (live-server.mjs) exposes a /source endpoint that reads and serves raw source code files from the project directory to the browser. While it includes basic path traversal protection, it allows internal code to be transmitted to the browser environment.
[PROMPT_INJECTION]: The 'critique' and 'live' commands ingest untrusted data from project source files (HTML, JSX, CSS) and user-generated annotations. This creates a surface for indirect prompt injection where malicious code or instructions embedded in the project files could attempt to influence the agent's design logic or downstream file operations.

impeccable