The Agent Skills Directory

[SAFE]: The skill operates within a highly restricted environment, using only Read, Grep, and Glob tools as defined in the skill configuration. It lacks the ability to execute code, modify system files, or perform network operations.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted external data, which is a necessary function for its code-review purpose but presents a standard ingestion surface.
Ingestion points: Reads files provided via the $ARGUMENTS variable and specific configuration files in the .styleseed/ directory (e.g., project.json, artifacts/index.json, bundles/*.md).
Boundary markers: The instructions do not specify delimiters or safety warnings for the ingested code content.
Capability inventory: The toolset is strictly limited to Read, Grep, and Glob. No high-risk capabilities like network access, file-writing, or subprocess execution are present.
Sanitization: The skill processes raw code and manifest files without explicit sanitization steps, though the impact is mitigated by the read-only output format.

ss-review