The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external project files to influence the generation of test code. Maliciously crafted design documents or existing source code could potentially introduce unwanted patterns or instructions into the agent's context during the scaffolding process.
Ingestion points: The skill reads project.yaml, .claude/docs/technical-preferences.md, existing test files via Glob, and system-specific Game Design Documents (GDDs) located in design/gdd/*.md.
Boundary markers: The instructions do not specify the use of delimiters or sanitization steps when interpolating content from the GDDs or existing test files into the generated code templates.
Capability inventory: The skill utilizes the Write tool to create new source files and the Bash tool to run a local configuration resolver.
Sanitization: No explicit sanitization or validation of the content extracted from GDDs or test files is performed before it is used for code generation.
[DYNAMIC_CONTEXT_INJECTION]: The skill employs the dynamic context injection syntax (!) to execute a shell command at load time. This command (bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys automation) is used to automatically resolve configuration settings for the agent's automation mode. The command is restricted to a local script within the project's internal hooks directory and does not accept user-supplied arguments, mitigating common injection risks.
[COMMAND_EXECUTION]: The skill is configured to execute a specific local bash script for configuration resolution. This capability is strictly scoped in the allowed-tools frontmatter to a specific path relative to the skill directory, limiting the potential for arbitrary command execution.

test-helpers