The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the platform's dynamic context injection syntax to include shared protocol files and local project configurations during the skill's initialization phase. Examples include commands that 'cat' files from the 'skills/_shared/' directory and the project root (e.g., '.production-grade.yaml'). These are benign file operations used to provide necessary context to the agent.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines procedures for reading and verifying project-specific files like 'default.project.json' and '.forgewright/project-profile.json'. While this introduces a surface for indirect prompt injection if these files were to contain malicious instructions, it is a standard and required practice for a developer agent to ground itself in the workspace. No specific exploitation logic was found, and the risk is considered low.

roblox-engineer