The Agent Skills Directory

[SAFE]: The skill is a highly specialized instruction set for code review, focusing on architectural integrity and project layering. It does not contain any malicious code, hidden instructions, or exfiltration patterns.
[CREDENTIALS_UNSAFE]: The skill explicitly addresses credential safety in Axis 27, forbidding the hardcoding of real license tokens and requiring assertions to use placeholders or opaque threading via environment variables.
[COMMAND_EXECUTION]: The skill mentions external tools like git, bun, and tsdown within the context of developer workflows and build processes. It strictly limits where sensitive Node.js APIs like child_process can be used in the codebase being reviewed.
[DATA_EXFILTRATION]: Access to network and file system APIs is strictly scoped to specific directories (e.g., http/**, core/npm-registry.ts) to prevent unauthorized data movement within the project structure.
[PROMPT_INJECTION]: The instructions reinforce the agent's role as a strict architectural auditor. There are no attempts to override the underlying system prompts or safety filters of the AI.
[REMOTE_CODE_EXECUTION]: The skill enforces a strict dependency budget for the client package (zod, semver, and node: builtins only), reducing the risk of supply chain attacks or execution of untrusted remote code.

review