The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses execFileSync in src/output.ts to execute osascript on macOS. This is used to control the Safari browser to open generated HTML files. The command is designed to close all existing Safari windows to provide a distraction-free view, a behavior that is explicitly documented in the SKILL.md. The input paths are properly URL-encoded using pathToFileURL to prevent shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown content to generate HTML companions.
Ingestion points: Markdown artifacts are read from the file system in src/readArtifact.ts.
Boundary markers: The skill does not use specific delimiters to wrap the content, but it treats section headings as structural boundaries.
Capability inventory: The skill can write files to the .superpowers-html/ directory and execute browser-opening commands via osascript.
Sanitization: The skill effectively mitigates risk by using isomorphic-dompurify and the marked library's parser to sanitize all generated HTML content, stripping potentially malicious <script> tags and on* event handlers before rendering (implemented in src/helpers/markdown.ts and individual component files).
[PERSISTENCE]: The skill includes a setup script (scripts/setup-htmlify-hook.sh) intended to install a PostToolUse hook. This ensures the skill automatically runs whenever specific Markdown files are modified within the Claude Code environment.

htmlify