The Agent Skills Directory

[COMMAND_EXECUTION]: The skill launches a local Node.js process to run scripts/dashboard-server.mjs. This server provides a web interface for managing writing projects, with the ability to read, modify, and delete files in the user's workspace. Security is managed by restricting the server to the loopback interface (127.0.0.1), verifying the request origin, and validating that file paths remain within the workspace boundary.\n- [REMOTE_CODE_EXECUTION]: The skill includes instructions to update itself by running npx skills add worldwonderer/oh-story-claudecode. This downloads and installs code from the author's official GitHub repository. This process is documented as user-initiated.\n- [EXTERNAL_DOWNLOADS]: To check for updates, the skill fetches metadata from GitHub's official release API (api.github.com).\n- [PROMPT_INJECTION]: The skill has the attack surface for indirect prompt injection as it processes data from writing projects. 1. Ingestion points: Reads local workspace files (.md, .txt, .json, .yaml) into the dashboard. 2. Boundary markers: No explicit prompt boundary markers are provided for ingested content. 3. Capability inventory: The dashboard server possesses file-writing and deletion capabilities. 4. Sanitization: Implements path validation, cross-origin request protection, and HTML escaping in the UI.

story