The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell scripts (scripts/start-server.sh, scripts/stop-server.sh) and Node.js to manage a local development server. These operations are restricted to the local environment and are necessary for the visual companion feature.
[SAFE]: The local server (scripts/server.cjs) is implemented using built-in Node.js modules (http, crypto, fs) to avoid external dependencies. It includes a 30-minute idle timeout and monitors the parent process PID to ensure it shuts down when the agent or user session ends.
[SAFE]: File access is limited to a session-specific directory (either in /tmp or a project-local .superpowers folder). The server includes path traversal protections by using path.basename when serving files from the content directory.
[SAFE]: Communication between the browser and the local server happens over WebSockets (RFC 6455). This is used exclusively to capture user interaction events (like clicking a design choice) and store them in a local state file for the agent to process, with no external data exfiltration detected.

brainstorming