The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions provide a command to install the Bun runtime via curl -fsSL https://bun.sh/install | bash. This is the official installation path for an established and well-known developer tool.
[COMMAND_EXECUTION]: The skill uses bun to execute its internal TypeScript CLI and utilizes Bun.spawn to open the rendered HTML deck in the default system browser. These commands are necessary for the primary function of displaying the feedback UI.
[DATA_EXPOSURE]: The tool manages its files within a dedicated local directory (~/.mkd/), where it stores spec files, rendered HTML, and result backups. This isolation ensures the skill does not clutter or expose data from the project's working directory.
[INDIRECT_PROMPT_INJECTION]: The skill generates a browser-based UI from a JSON specification and returns user-provided text and selections. The implementation includes a custom markdown renderer (markdown.ts) that explicitly escapes HTML special characters before processing, preventing content from injecting live scripts or malicious markup into the user's browser context.

mkd