The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its data ingestion process. It reads external files and provides their content as context to subagents using the Task tool.
Ingestion points: Multiple files including production/review-mode.txt, design/gdd/game-concept.md, design/player-journey.md, design/ux/interaction-patterns.md, and .claude/docs/technical-preferences.md are processed and their contents are passed into the agent's context.
Boundary markers: The instructions do not define delimiters (such as XML tags or special markers) to isolate ingested file content from the agent's core instructions.
Capability inventory: The skill possesses a powerful set of tools, including Bash, Task, Write, Edit, and TodoWrite, which could be targeted if a subagent is successfully influenced by malicious data.
Sanitization: There is no evidence of filtering or validation for the content read from these external files.
[COMMAND_EXECUTION]: The skill utilizes the Bash and Task tools to orchestrate workflows and spawn subagents like gamedev:ux-designer and gamedev:ui-programmer. Notably, the subagent_type for the engine UI specialist is dynamically determined by reading the .claude/docs/technical-preferences.md file. This creates a control-flow risk where a user or an external process modifying that configuration file could cause the orchestrator to spawn an unintended or malicious subagent.

team-ui