The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data to generate development artifacts and implementation stories, creating a surface for indirect injection.
Ingestion points: Untrusted data enters the agent context through game brainstorming sessions, project documentation requests (bmad-gds-document-project), and user-defined game briefs.
Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore embedded commands within the game concepts or code it processes.
Capability inventory: The skill utilizes Bash and Write tools to initialize test frameworks, create implementation stories, and execute development tasks.
Sanitization: No explicit sanitization or validation logic is described for the content interpolated from user concepts into development instructions.
[COMMAND_EXECUTION]: The skill documentation describes the use of shell commands and project-specific CLI tools (e.g., unity-mcp) to manage game project state and testing environments. While these are legitimate for the skill's purpose, they represent a powerful capability tier.
[EXTERNAL_DOWNLOADS]: The skill provides installation instructions pointing to external GitHub repositories for templates and modules.
Evidence: References https://github.com/supercent-io/skills-template for installation and https://github.com/bmad-code-org/bmad-module-game-dev-studio for upstream documentation. These are well-known hosting services and the references are consistent with the skill's stated purpose.

bmad-gds