The Agent Skills Directory

[COMMAND_EXECUTION]: The skill manages a local Node.js web server using shell scripts (start-server.sh, stop-server.sh). It utilizes child_process.exec and execFile within the server logic to launch the user's default web browser across different platforms (macOS, Linux, Windows).
[DYNAMIC_EXECUTION]: The visual companion server dynamically wraps HTML content fragments into a predefined frame template at runtime, injecting a helper script for browser-to-agent communication.
[INDIRECT_PROMPT_INJECTION]: The skill includes a subagent template (spec-document-reviewer-prompt.md) designed to ingest and analyze user-created specification documents. It also reads browser interaction data from a local event log (state_dir/events) to inform its creative recommendations.
[SAFE]: The local server implementation follows security best practices for development tools. It uses cryptographically strong session tokens passed via URL parameters and mirrored in HttpOnly cookies to gate access. It enforces strict security headers, including Content Security Policy (CSP) and X-Frame-Options, and validates that requested files are regular files residing within the designated content directory to prevent path traversal.

brainstorming