The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is explicitly instructed to ingest and follow repository-local instructions from multiple sources, which may be controlled by an external actor in a shared repository environment.
Ingestion points: The skill reads AGENTS.md, CLAUDE.md, the nearest path-scoped instructions (e.g., Assets/CLAUDE.md), ProjectSettings/ProjectVersion.txt, Packages/manifest.json, Packages/packages-lock.json, and various asmdef files or existing tests.
Boundary markers: No explicit delimiters or instructions to ignore embedded malicious prompts within these files are defined.
Capability inventory: The skill is granted powerful capabilities including Bash, Write, and Edit tools via its configuration.
Sanitization: There are no sanitization or validation steps mentioned for the content read from these repository files before the agent acts upon them.
[COMMAND_EXECUTION]: The skill workflows involve executing shell commands to verify the environment and project state, including using the Unity CLI for status checks and test execution.
Evidence: Phase 4 in references/claude-skill.md utilizes unity status --json and other CLI interactions to validate the installation and runtime environment.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install external tooling if it is missing from the environment.
Evidence: references/claude-skill.md states: 'If it is missing, install the official CLI under the standing authorization before continuing.' While targeting official Unity tools, this pattern involves fetching and executing code from broad network sources.

test-setup