The Agent Skills Directory

[SAFE]: The visual companion server (scripts/server.cjs) implements session-based authentication using a cryptographically random token.
[SAFE]: The server protects against directory traversal and symlink attacks when serving files from the content directory by using fs.realpathSync and verifying that the final path resides within the intended directory.
[SAFE]: Sensitive session information, including the authentication token and port, is stored with restricted file permissions (chmod 600) in the project's local state directory.
[SAFE]: The skill uses built-in Node.js modules for the server and helper scripts, avoiding external package dependencies and related supply-chain risks.
[EXTERNAL_DOWNLOADS]: The server references a branding image from primeradiant.com. This is a static asset reference for the tool's user interface.
[COMMAND_EXECUTION]: The skill executes local commands to start the server and open the system browser. Browser opening is handled safely using execFile where applicable.
[SAFE]: The skill ingests user interactions from the visual companion via a local events file. This ingestion is mediated by the server which validates the data format, and the agent's behavior is constrained by the instructions in SKILL.md, minimizing risks of indirect injection.

brainstorming