The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell scripts (scripts/start-server.sh and scripts/stop-server.sh) to manage a local Node.js server (server.cjs). This server is used to host the Visual Companion web interface for brainstorming.
[SAFE]: The local Node.js server implementation (server.cjs) follows security best practices for its use case. It binds to the loopback interface (127.0.0.1) by default, uses a random high port, and restricts file access to a specific session directory using path sanitization (path.basename).
[SAFE]: The skill implements an indirect prompt injection surface by reading user browser interactions from a local .events file. This is an intended functional requirement for capturing user choices during the visual brainstorming process.
Ingestion points: User interactions captured by scripts/helper.js are written to SCREEN_DIR/.events by the Node.js server.
Boundary markers: None.
Capability inventory: Subprocess execution via start-server.sh, file system access (read/write).
Sanitization: None.

brainstorming