The Agent Skills Directory

[SAFE]: The skill is designed to be highly self-contained, utilizing Node.js built-in modules (node:fs, node:path, node:crypto) and avoiding external NPM dependencies, which significantly mitigates supply chain risks.
[SAFE]: Prompt construction is handled by a deterministic compiler that stitches together content from character bibles and user-supplied specifications. The process uses explicit machine markers (e.g., ) to extract content safely and validates all inputs against rigorous internal schemas (e.g., registry-report.mjs, schemas.mjs).
[SAFE]: Secret management follows industry standards, retrieving API keys from environment variables or a specific user-level configuration file (~/.pontistudios.studio.yml). The skill includes logic to detect and warn the user if configuration files have unsafe (group or world-readable) permissions.
[SAFE]: All network operations are conducted over HTTPS to well-known service providers, specifically OpenRouter for AI model inference and user-configured Cloudflare R2 for media storage. The skill implements its own SigV4 signing for R2, maintaining transparency in how data is transmitted.
[SAFE]: File operations are restricted to the skill's own data directories, designated user inboxes (e.g., ~/Pictures/imagegen/_inbox), or explicitly provided paths. The logic for reading local data, such as log backfilling, is well-defined and confined to the skill's operational scope.

studio-workflows