The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a shell wrapper and Node.js script to execute processing logic. It uses standard parseArgs and local execution without spawning arbitrary shells or executing remote scripts.
[CREDENTIALS_SAFE]: The skill manages API keys using environment variables and a local YAML configuration file (~/.pontistudios.studio.yml). It does not contain hardcoded secrets and explicitly mentions that exported variables override file configurations, following security best practices for secret management.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied master scripts (JSON) by interpolating them into model prompts. While this is a data ingestion surface, the skill implements schema validation using a local validation library to ensure the LLM output matches the expected JSON structure, reducing the impact of potential injection.
[EXTERNAL_DOWNLOADS]: The skill depends on a sibling skill directory (../../../studio-core) for shared libraries and configuration management. These references are local to the environment and do not involve fetching code from untrusted remote sources.

studio-video