The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (e.g., project names and concept descriptions) and interpolates these values into shell commands.
Ingestion Point: User input is gathered via the AskUserQuestion tool in Step 1.
Evidence: In Step 4, the user-provided <Name> is used in unity projects create "<Name>", and in Step 7 it is used in git commit -m "Initial Unity project: <Name>".
Capability: The skill has access to the Bash tool, providing a surface for command injection if the input is not properly sanitized.
Sanitization: No explicit shell-escaping or validation logic for user input is described.
[COMMAND_EXECUTION]: The skill leverages a vendor-specific CLI tool (unity) and git to perform administrative and development tasks.
Evidence: The workflow includes commands for authentication (unity auth login), software installation (unity install lts), and version control (git add, git commit).
[DYNAMIC_EXECUTION]: The skill automates the configuration of the Unity Editor by generating and executing C# code snippets.
Evidence: Step 6 describes applying visual baseline settings "by running C# in it" using the unity command interface to modify internal Editor state at runtime.

new-unity-project