The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the exclamation-backtick syntax to execute a shell command automatically when the skill is loaded. Specifically, it calls a project-local script 'yaml-helper.sh' to resolve configuration settings such as review mode and workflow density. While this is used for legitimate project configuration, it constitutes execution of a local shell script triggered by the platform's skill loading mechanism.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the user (game hints, genre descriptions) and reads existing project files (design briefs, project.yaml). This data is interpolated into prompts for the agent and various sub-agents (e.g., Creative Director, Technical Director) without explicit sanitization or strict boundary markers. This creates a surface where embedded instructions in processed data could potentially influence the agent's file-writing or tool-use operations. Evidence: 1. Ingestion points: User hints and descriptions in SKILL.md, design briefs and concept files in full-concept.md. 2. Boundary markers: No specific delimiters or instructions to ignore embedded commands are used for user content. 3. Capability inventory: Access to 'Write' for file creation, 'Bash' for configuration, and 'Agent' for multi-agent workflows. 4. Sanitization: No explicit filtering of external content before prompt interpolation.
[COMMAND_EXECUTION]: The skill's configuration in the YAML frontmatter limits the Bash tool to executing a specific local script ('yaml-helper.sh') with a defined sub-command ('resolve_config'). While this restriction is a positive security control, the skill relies on executing local system commands to function, which is documented here for visibility.

brainstorm