The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands for game development workflows. Specifically, references/build-brief-contract.md defines command execution points for install, buildOrExport, start, and verify. These commands are derived from design specifications and are intended to run in the target environment to validate the build.
[EXTERNAL_DOWNLOADS]: The skill interacts with the Volcengine (火山引擎 Ark) API at ark.cn-beijing.volces.com for image and video generation as described in references/generative-media-pipeline.md. This is a well-known service provided by ByteDance. The instructions explicitly mandate using environment variables for API keys and advise against logging or storing credentials in the workspace, which is a safe practice.
[INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection because it ingests and processes untrusted data from design documents to drive agent behavior.
Ingestion points: The skill reads GAME_DESIGN.md, ART_DIRECTION.md, and PRODUCT_BRIEF.md to construct the BUILD_BRIEF.md and execute implementation tasks.
Boundary markers: Absent. There are no explicit instructions or delimiters provided to the agent to disregard instructions potentially embedded within the design documents.
Capability inventory: The skill possesses high-privilege capabilities, including shell command execution (install, build, verify) and network access to external APIs.
Sanitization: No evidence of sanitization or filtering of input data from design documents before it is used to generate commands or instructions for implementation.

game-build