The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation file references/release/launch-and-post-launch.md and the corpus file references/corpus/production-business-live/post-launch-operations.md include a source link to https://script2shorts.app/blog/game-devlog-content-strategy. This domain has been identified as a phishing site by automated security scans. Directing the agent or user to malicious domains is a critical security risk.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze project-level data provided by the user, such as Godot project files and manifest files (package.json), to provide field knowledge and launch advice.
Ingestion points: The routing signal (Signals 18 and 19 in SKILL.md) specifically triggers when project configuration files are encountered.
Boundary markers: There are no safety instructions requiring the agent to ignore or isolate instructions that may be embedded in these untrusted files.
Capability inventory: The agent uses project fingerprints to provide specific business and development guidance, potentially allowing an attacker to influence the agent's output through crafted configuration data.
Sanitization: The skill lacks validation steps for the content of the analyzed files.

game-knowledge