The Agent Skills Directory

[COMMAND_EXECUTION]: The skill launches a local Node.js server (scripts/server.cjs) via a bash script (scripts/start-server.sh) to host the visual companion tool. The server binds to a local port and monitors its parent process to ensure it shuts down when the agent session ends.
[DATA_EXPOSURE]: The server logs user interactions from the browser (clicks/choices) to a local file in the session directory ($STATE_DIR/events). This data is used by the agent to understand user preferences during the design phase.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data via browser interactions.
Ingestion points: Browser events are recorded to a local state directory ($STATE_DIR/events) by the Node.js server.
Boundary markers: Interaction data is captured and stored as structured JSON lines, providing clear separation from instructional content.
Capability inventory: The skill has the capability to write design documents to the project's documentation directory and invoke subsequent implementation planning skills.
Sanitization: Input is constrained to specific interaction types (clicks on UI elements) defined in the helper.js script, which limits the surface area for injecting arbitrary instructions.

brainstorming