The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly direct the agent and its subagents to bypass the 'Collaboration Protocol,' which normally requires asking for user permission before writing or editing files. The text states: 'A subagent spawned here writes without asking, and that is a deliberate, bounded exception... Do not "fix" this by asking per subagent.' This is a direct override of standard safety and transparency guidelines intended to prevent unauthorized file modifications.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the ! syntax (!bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config ...) to execute a shell command at the moment the skill is loaded. This command interacts with local hooks to resolve configuration parameters like review_mode and team.size before the user has even engaged with the agent.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads various external documents (Game Design Documents, narrative briefs, and lore files) and incorporates their content into instructions for subagents.
Ingestion points: Multiple files including design/gdd/game-concept.md, design/gdd/game-pillars.md, and various files in design/levels/ and design/narrative/.
Boundary markers: The skill lacks explicit boundary markers or 'ignore embedded instructions' warnings when passing data from these files to subagents.
Capability inventory: The skill has the capability to spawn new subagents (Agent tool), write and edit files, and execute specific bash commands.
Sanitization: There is no evidence of sanitization or filtering of the content read from external design files before it is used to brief subagents.
[COMMAND_EXECUTION]: The skill employs the Bash tool to run a local script (yaml-helper.sh). Although the allowed-tools configuration limits this tool to a specific script path and a resolve_config command, it remains an execution of local shell logic as part of the skill's operational flow.

team-level