The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/initialize_project_docs.mjs uses child_process.spawnSync to execute a local management script (workflow-control.mjs). This is used to perform workflow 'preflight' checks within the project structure. The execution is handled safely by calling the Node.js binary directly with an argument array rather than using a shell, preventing shell injection vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and coordinate various user-provided project files (e.g., GDD.md, TDD.md, visual-assets.json) throughout the game development lifecycle. While this introduces an attack surface for indirect prompt injection, the skill defines clear roles and hierarchical status checks to minimize the impact of embedded instructions.\n
Ingestion points: Project documents located in the docs/ directory and workflow state files in .workflow-control/.\n
Boundary markers: The instructions define a strict hierarchy where the control plane is the 'sole authority' for state, providing a conceptual boundary for instruction following.\n
Capability inventory: The skill can execute local Node.js scripts via its own utility scripts and write documentation files to the project root.\n
Sanitization: The initialization script includes validation for the project root path to prevent directory traversal or operations on the filesystem root.\n- [EXTERNAL_DOWNLOADS]: The documentation and capability profiles reference official resources from threejs.org and well-known, established community utility libraries on GitHub, such as gkjohnson/three-mesh-bvh and isaac-mason/recast-navigation-js. These references are standard for the Three.js ecosystem and target trusted or well-recognized sources.

threejs-game-orchestrator