The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external and local sources, which could lead to indirect prompt injection if those sources contain malicious instructions.
Ingestion points: The skill performs web searches for engine migration guides, changelogs, and deprecated API lists, then extracts and interpolates this data into the project's reference documentation (references/11-upgrade.md, references/7-reference-docs.md). It also reads project design documents like design/game-brief.md and design/gdd/game-concept.md to determine project scope and engine needs (references/2-guided-mode.md).
Capability inventory: The skill possesses significant capabilities, including executing shell commands via Bash, searching and fetching content from the web (WebSearch, WebFetch), and performing file system writes and edits (Write, Edit).
Boundary markers: There are no explicit instructions to use delimiters or boundary markers when processing ingested external data to prevent the model from following embedded commands.
Sanitization: The skill lacks explicit sanitization or validation of the content fetched from the web or read from project files before it is used in documentation generation or configuration updates.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the dynamic context injection syntax (!) to execute a shell command during the skill load phase: !bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys workflow``. This command is used to dynamically retrieve project configuration settings, such as the workflow tier, into the agent's context.
[EXTERNAL_DOWNLOADS]: The skill automates the download and installation of project dependencies and development tools from established services.
Node.js Packages: It triggers npm ci to install project dependencies from the npm registry, ensuring a clean install based on the lockfile (references/web.md).
Browser Binaries: It may download Playwright browser binaries from official sources to enable automated testing (references/web.md).
[DYNAMIC_EXECUTION]: The skill generates shell command strings for building, testing, and running projects based on user input and engine templates. These strings are stored in project.yaml and technical-preferences.md for later execution by the agent or CI/CD tools.

setup-engine