The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file utilizes the dynamic context injection syntax (!bash ...) to execute a local script (yaml-helper.sh) at load time. This is used to resolve project-specific configuration keys such as automation, workflow, and docs.density, allowing the skill to adapt its behavior based on the current environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from various external and user-controlled files, creating a surface for indirect prompt injection where malicious instructions embedded in those files could influence the agent's behavior.
Ingestion points: The agent reads from design/gdd/*.md, design/player-journey.md, design/ux/*.md, design/art/art-bible.md, and project configuration files (project.yaml).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing content from these files.
Capability inventory: The skill has the capability to write and edit project files (Write, Edit tools) and execute restricted shell commands (Bash tool).
Sanitization: There is no evidence of sanitization or escaping of external content before it is processed or used to draft new documentation.
[PROMPT_INJECTION]: The skill documentation in SKILL.md references an 'autonomous' mode (governed by .claude/docs/automation-modes.md) where the agent 'logs and proceeds' without direct user interaction for certain tasks. While the skill's own authoring instructions mandate user approval for file writes, the systemic support for autonomous operation represents a reduction in user oversight.
[COMMAND_EXECUTION]: The skill configures the Bash tool using a restrictive pattern in the allowed-tools frontmatter. It limits shell execution to a specific helper script (yaml-helper.sh) located in the project's hooks directory. While this is a security hardening measure that prevents arbitrary command execution, it confirms the skill's reliance on executing local scripts.

ux-design