The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a bundled script (scripts/preview.mjs) to automate project inspection and preview generation. This script is designed to operate locally and includes robust path validation to ensure it stays within the repository and avoids sensitive locations like .env, node_modules, or .git folders. The script execution is the primary mechanism for the skill's branding analysis and is clearly documented in the workflow.
[INDIRECT_PROMPT_INJECTION]: The tool identifies branding surfaces by reading local source files (CSS and React/Next.js components). This ingestion is a required part of the skill's function.
Ingestion points: scripts/preview.mjs reads repository-relative files to extract branding tokens.
Boundary markers: The script uses an explicit directory exclusion list (SKIP_DIRECTORY_NAMES) and regex patterns to identify relevant tokens while ignoring semantic status colors.
Capability inventory: The script performs local file reads, writes to a .hermai/ directory, and hosts a local HTTP server on 127.0.0.1.
Sanitization: Content is sanitized using HTML escaping for brand data, and the local server enforces a restrictive Content Security Policy (CSP) that disables scripts and external resource loading.

brand-preview