The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell scripts (start-server.sh, stop-server.sh) and a Node.js server (server.cjs) to manage a visual brainstorming companion. The server securely handles browser launches using child_process.execFile and follows established security patterns for local development tools.
[DATA_EXPOSURE]: The visual companion server implements session authentication using a generated 32-byte token passed via query parameters and mirrored into a HttpOnly cookie. This prevents unauthorized access to the brainstorming content by other local processes or remote actors. Additionally, the server employs strict path traversal checks (isRegularFileInsideContentDir) when serving files from the session directory.
[PROMPT_INJECTION]: The skill contains strong behavioral directives (e.g., <HARD-GATE>) to ensure the agent follows a specific design-before-implementation workflow. These are functional constraints rather than malicious attempts to override AI safety filters.
[SAFE]: The server implementation includes standard security headers such as Content-Security-Policy, X-Frame-Options: DENY, and Cross-Origin-Resource-Policy. All network and file operations are scoped to the project's local environment with appropriate permissioning (umask 077).

obra-superpowers