Skip to content
Back to skills

Speckit.Game Embedded

ASecurity

Embedded Game & WASM Bridge Specialist - Unity WebGL, Godot 4 Web/WASM, PlayCanvas, 2-Way JS Bridge, COOP/COEP Headers, Brotli Streaming, and Shell UI Integration.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 24, 2026
ai-agentsjavascripttypescriptgojavac#shellreactvuenextjsrails

Works with

  • api

Security analysis

A100/100

Scanned September 24, 2026

npx -y skills add wedabro/bro-skills --skill speckit.game-embedded --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Speckit.Game Embedded?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Speckit.Game Embedded
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/wedabro-speckit-game-embedded/badge)](https://www.skillsdirectory.com/skills/wedabro-speckit-game-embedded)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: speckit.game-embedded
description: Embedded Game & WASM Bridge Specialist - Unity WebGL, Godot 4 Web/WASM, PlayCanvas, 2-Way JS Bridge, COOP/COEP Headers, Brotli Streaming, and Shell UI Integration.
---

## Mission
Architect, optimize, and integrate embedded game engines (Unity WebGL, Godot 4 HTML5/WASM, PlayCanvas, Defold, or Iframe sandboxes) into modern Web Platforms (React, Next.js, Vue, Vanilla TS). Ensure seamless 2-way communication, optimal WASM loading performance, proper security headers for multi-threading, and responsive container scaling.

## Inputs and Outputs
- Read `.agents/specs/[feature]/spec.md`, `plan.md`, `tasks.md`, target engine export artifacts, bridge event schemas, and platform SDK specifications.
- Produce typed bridge dispatcher (`GameBridge.ts`), responsive shell container component (`GameContainer.tsx`/`vue`), loading screen with lifecycle hooks, server headers (COOP/COEP, Brotli), and platform connectors.

## Protocol

### 1. Two-Way Bridge Architecture (Web ⇋ Engine)
- **Type-Safe Dispatcher**: Define strict TypeScript interfaces for all outbound actions and inbound events.
- **Web ➔ Engine (Call into Game)**:
  - *Unity*: Use `unityInstance.SendMessage(gameObjectName, methodName, jsonPayload)`.
  - *Godot*: Use `JavaScriptBridge.eval()` or trigger registered callback handlers.
  - *Iframe / Web Worker*: Use `window.postMessage` with strict `targetOrigin` verification (never use `*` in production).
- **Engine ➔ Web (Game Events to Shell)**:
  - *Unity*: Implement C# `.jslib` plugins calling global bridge functions: `window.dispatchGameEvent(eventName, data)`.
  - *Godot*: Use `JavaScriptBridge.get_interface("window").dispatchGameEvent(eventName, data)`.
- **Validation**: Validate all incoming event payloads using schemas (e.g. Zod) before updating Web state.

### 2. Web Shell & Responsive Container Management
- **Aspect Ratio Locking**: Wrap game canvas in a responsive container with aspect-ratio preservation (`16:9`, `4:3`, `9:16` for mobile vertical) using CSS Letterbox / Pillarbox.
- **Orientation & Fullscreen**:
  - Implement Fullscreen API handler with fallback for iOS Safari.
  - Listen to `ScreenOrientation` change events; show rotate device overlay when orientation is incompatible.
- **Focus & Input Trapping**:
  - Automatically manage Canvas focus/blur to capture keyboard game inputs (Arrow keys, Spacebar) while preventing unwanted page scrolling.
  - Release focus when user interacts with Web DOM overlays (modals, chat inputs).

### 3. Loading, Preloading & Asset Streaming
- **Granular Loading Screen**: Parse engine loading lifecycle hooks:
  1. Engine Runtime Fetching (`.wasm`, `.framework.js`)
  2. Asset Data Downloading (`.data`, `.pck`)
  3. WASM Compilation & Instantiation
  4. Game Scene Ready
- **Persistent Caching**: Configure Service Worker or IndexedDB caching for large WASM blobs and asset packages to enable instant subsequent loads and offline play.

### 4. Server & DevOps Infrastructure
- **SharedArrayBuffer & Multi-Threading (COOP / COEP)**:
  For Godot 4 / Unity multi-threaded builds, enforce HTTP response headers in Nginx/Caddy/Vite:
  ```http
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Embedder-Policy: require-corp
  ```
- **Compression**: Pre-compress build outputs (`.wasm`, `.data`, `.pck`) using **Brotli (`.br`)** and **Gzip (`.gz`)**, serving with proper `Content-Encoding` and `Content-Type: application/wasm`.

### 5. Platform SDKs & Monetization Hooks
- **Platform Integrations**:
  - *Telegram Mini Apps*: Integrate `@twa-dev/sdk` (BackButton, MainButton, CloudStorage, HapticFeedback).
  - *Discord Activities*: Integrate `@discord/embedded-app-sdk`.
- **Monetization & Ads**: Implement interstitial / rewarded video ad lifecycle (pause game loop & audio during ad, resume on completion).

## Completion Gate
Two-way bridge messages typed and validated, loading screen lifecycle verified with error fallback, COOP/COEP headers configured for multi-threaded WASM, and audio suspends on document visibility change.

## Guard Rails
- FORBIDDEN: Using `postMessage('*')` without origin validation.
- FORBIDDEN: Hardcoding asset paths or API endpoints inside game exports (must be injected via bridge or ENV query params).
- FORBIDDEN: Omitting COOP/COEP headers when the engine requires `SharedArrayBuffer` (causes silent black screens or crashes).
- FORBIDDEN: Leaving audio playing in background when user navigates away or tab is hidden (`document.hidden`).

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.