The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script (scripts/studio-run.mjs) to initialize projects, manage assets, and validate stage transitions. These commands operate exclusively on local files within the project's .styleseed directory and do not involve shell injection vulnerabilities or unauthorized system access.
[INDIRECT_PROMPT_INJECTION]: The pipeline ingests external product briefs and references that are subsequently stored in brief.md and references.json. While this presents a surface for indirect prompt injection, the risk is minimized by the skill's architecture, which requires human selection of design directions and uses structured JSON validation for all pipeline stages.
[DATA_EXPOSURE_AND_EXFILTRATION]: No network operations or credential harvesting patterns were detected. The script uses standard node:fs modules for local project management. All file operations are scoped to the project root and the .styleseed metadata directory.
[REMOTE_CODE_EXECUTION]: The skill does not download or execute remote code. It relies on local relative imports (../../ss-resolve and ../../ss-score) which are expected components of the broader StyleSeed ecosystem in the intended execution environment.

ss-studio