The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-supplied game briefs, brainstorming documents, and research materials to populate the Game Design Document (GDD). Maliciously crafted inputs could attempt to override agent instructions or exfiltrate context through the GDD generation process.
Ingestion points: SKILL.md (On Activation, Discovery, and Update intents) where external documents are processed to extract core fantasy, mechanics, and scope constraints.
Boundary markers: Technically absent in the provided templates; however, the skill's instructions explicitly enforce a "Extract, don't ingest" policy, delegating processing to subagents to protect the primary context.
Capability inventory: The skill has the capability to write files (gdd.md, epics.md, decision-log.md) and execute local scripts (render-validation-html.py).
Sanitization: The render-validation-html.py script uses html.escape() to sanitize findings before rendering the final HTML validation report.
[COMMAND_EXECUTION]: The skill executes local Python scripts using the uv run command for critical lifecycle steps.
Evidence: SKILL.md executes {project-root}/_bmad/scripts/resolve_customization.py during activation and scripts/render-validation-html.py for rendering validation reports.
[DYNAMIC_EXECUTION]: The skill generates dynamic content by substituting user-derived data into HTML and Markdown templates.
Evidence: scripts/render-validation-html.py utilizes string.Template.safe_substitute to generate reports from validation-findings.json, which contains data extracted from the GDD artifacts.

gds-gdd