The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to start a local Node.js server and open browser tabs.\n
Evidence: scripts/start-server.sh executes node server.cjs to start the companion server.\n
Evidence: scripts/server.cjs uses child_process.execFile and child_process.exec to launch system browsers using platform-specific commands like open, rundll32.exe, and xdg-open.\n- [EXTERNAL_DOWNLOADS]: Fetches a remote branding logo from a vendor-controlled domain when explicitly enabled.\n
Evidence: scripts/server.cjs contains a URL reference to https://primeradiant.com/brand/superpowers-visual-brainstorming-logo.png. This fetch is disabled by default and requires the SUPERPOWERS_BRANDING environment variable to be set.\n- [DYNAMIC_EXECUTION]: Manages a local Node.js server process at runtime to facilitate the visual companion functionality.\n
Evidence: The skill includes a complete HTTP/WebSocket server in scripts/server.cjs. It implements security controls such as 32-byte hex token authentication (crypto.randomBytes) for all requests and path validation (isRegularFileInsideContentDir) to prevent traversal attacks.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes structured interaction data from the browser companion that influences agent behavior.\n
Ingestion points: The agent is instructed in SKILL.md and references/visual-companion.md to read $STATE_DIR/events to process user interactions from the browser.\n
Boundary markers (absent): The agent is instructed to merge this data with terminal feedback, but no specific prompt delimiters or "ignore embedded instructions" warnings for the event file content are required by the instructions.\n
Capability inventory: Across scripts, the skill uses child_process.execFile (in scripts/server.cjs) and file writing (scripts/server.cjs writes to STATE_DIR/events and CONTENT_DIR). The agent interprets the resulting event data to transition between design states.\n
Sanitization (present): Browser events are captured as structured JSON objects by the server and appended to the events file.

brainstorming