fix(allowed-tools): remove commas, use whitespace

README.md

@@ -171,15 +171,15 @@ Use `SPEC.md` as the maintenance contract for the skill. It should describe inte
 |-------|-------------|
 | `license` | License name or path to license file |
 | `compatibility` | Environment requirements (max 500 chars) |
-| `allowed-tools` | Comma-separated list of tools the skill can use |
+| `allowed-tools` | Space-separated list of tools the skill can use. Do not use commas: Warden drops comma-suffixed names like `Read,` |
 | `metadata` | Arbitrary key-value pairs for additional properties |
 
 ```yaml
 ---
 name: my-skill
 description: What this skill does
 license: Apache-2.0
-allowed-tools: Read, Grep, Glob
+allowed-tools: Read Grep Glob
 ---
 ```
 

skills/django-access-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: django-access-review
 description: 'Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".'
-allowed-tools: Read, Grep, Glob, Bash, Task
+allowed-tools: Read Grep Glob Bash Task
 license: LICENSE
 ---
 

skills/django-perf-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: django-perf-review
 description: Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems.
-allowed-tools: Read, Grep, Glob, Bash, Task
+allowed-tools: Read Grep Glob Bash Task
 license: LICENSE
 ---
 

skills/security-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: security-review
 description: Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
-allowed-tools: Read, Grep, Glob, Bash, Task
+allowed-tools: Read Grep Glob Bash Task
 license: LICENSE
 ---
 

skills/skill-scanner/SKILL.md

@@ -4,7 +4,7 @@ description: Scan agent skills for security issues. Use when asked to "scan a sk
   "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md",
   or assess whether an agent skill is safe to install. Checks for prompt injection,
   malicious scripts, excessive permissions, secret exposure, and supply chain risks.
-allowed-tools: Read, Grep, Glob, Bash
+allowed-tools: Read Grep Glob Bash
 ---
 
 # Skill Security Scanner

skills/triage-frontend-issues/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: triage-frontend-issues
 description: Triage new issues in the Sentry `javascript` project by archiving non-actionable noise. Use when asked to "triage issues", "triage the javascript project", "archive non-actionable issues", "triage new frontend issues", or "clean up the sentry/javascript queue". Operates only on the sentry/javascript project, only archives (never resolves), and always archives with `untilEscalating`.
-allowed-tools: Read, mcp__sentry__search_issues, mcp__sentry__get_sentry_resource, mcp__sentry__update_issue
+allowed-tools: Read mcp__sentry__search_issues mcp__sentry__get_sentry_resource mcp__sentry__update_issue
 ---
 
 # Triage Frontend Issues