The Agent Skills Directory

[SAFE]: The local dashboard server implements robust security controls, including binding to loopback addresses only (127.0.0.1, ::1, localhost). It validates the Host and Origin headers to prevent unauthorized cross-site requests and uses a strict allowlist for serving static assets, preventing directory traversal via the web interface.\n- [COMMAND_EXECUTION]: The dashboard-server.mjs script utilizes the Node.js spawn module to execute powershell.exe for atomic file replacement on Windows systems, using environment variables to safely pass file paths. It also employs OS-specific commands like open, start, and xdg-open to launch the user's default browser when the dashboard starts.\n- [EXTERNAL_DOWNLOADS]: The skill performs version checks by querying the GitHub API for the latest release tags of the HeRiki/oh-story-codex repository. This is a neutral, user-notified update mechanism targeting a well-known service and the author's own repository.\n- [SAFE]: File system operations within the dashboard are protected against path traversal attacks. The server resolves the absolute paths of all requested files and verifies they are contained within the designated workspace root using a dedicated isPathInside validation function.

story