The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !bash syntax in SKILL.md to execute a local configuration resolver (yaml-helper.sh) at load time. This is used to fetch project settings like automation mode and QA levels to customize the skill's behavior.
[INDIRECT_PROMPT_INJECTION]: The skill reads configuration data from local files that could be influenced by external contributors.
Ingestion points: Phase 1 (references/1-detect.md) reads project.yaml and .claude/docs/technical-preferences.md to detect the configured game engine and existing infrastructure.
Boundary markers: No specific boundary markers or "ignore instructions" prompts are used when reading these files.
Capability inventory: The skill has access to file-writing tools and shell execution, which could be misused if malicious instructions were injected into the configuration files.
Sanitization: The skill does not appear to sanitize or strictly validate the values read from the configuration files before incorporating them into its logic.
[COMMAND_EXECUTION]: The skill is configured with permissions to execute local bash scripts (test-scaffold.sh, yaml-helper.sh) and standard engine CLI commands for Godot, Unity, and Unreal. These are used to verify engine versions and verify project structures.
[EXTERNAL_DOWNLOADS]: The skill generates GitHub Actions workflows that pull in external actions from the actions, game-ci, and godot-gdunit-labs organizations. These are recognized as well-known or trusted sources for the target platforms.

test-setup