The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes a local Node.js server (server.cjs) to dynamically serve HTML fragments generated by the agent. These fragments are used to render visual mockups and diagrams within the user's browser.
[COMMAND_EXECUTION]: The server script employs child_process.exec and child_process.execFile to open the system's web browser automatically. It mitigates injection risks by using JSON.stringify to escape arguments and preferring non-shell execution for standard platform launchers.
[INDIRECT_PROMPT_INJECTION]: The agent is instructed to ingest user interaction events (such as button clicks) from a local JSON lines file (state_dir/events). While this introduces a data ingestion surface, the risk is minimized by the server's local binding and session-key authentication.
[EXTERNAL_DOWNLOADS]: The visual companion's header references a brand logo from an external domain (primeradiant.com). this is a standard asset reference for the tool's interface.
[SAFE]: The implementation follows security best practices for local development tools, including the use of owner-only file permissions (umask 077), constant-time token comparisons (timingSafeEqual), path validation to prevent traversal, and a watchdog mechanism that terminates the server if the parent process exits.

brainstorming