The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell scripts (start-server.sh, stop-server.sh) to manage the lifecycle of a local Node.js server. These scripts handle PID management and session cleanup, representing standard tool operations for providing a visual interface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from untrusted sources, specifically project files (code, docs, commits) and browser interaction events. This creates a potential surface for indirect prompt injection. However, the skill implements this as a core feature for codebase exploration and brainstorming, and the risks are mitigated by the specific design-focused instructions and the lack of automated code execution from these inputs.
[SAFE]: The 'Visual Companion' server (server.cjs) is a minimal, hand-rolled implementation using only built-in Node.js modules, reducing the supply-chain attack surface. It includes security features such as path.basename validation on file requests to prevent directory traversal and an automatic idle timeout (30 minutes) to ensure the server does not remain running indefinitely.

brainstorming