Back to skills
SKILL.md
Speckit.Game Embedded
ASecurityEmbedded Game & WASM Bridge Specialist - Unity WebGL, Godot 4 Web/WASM, PlayCanvas, 2-Way JS Bridge, COOP/COEP Headers, Brotli Streaming, and Shell UI Integration.
- 2 stars
- 0 votes
- 0 copies
- 0 views
- Added September 24, 2026
Works with
Security analysis
100/100npx -y skills add wedabro/bro-skills --skill speckit.game-embedded --agent claude-codeAre you the author of Speckit.Game Embedded?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/wedabro-speckit-game-embedded)---
name: speckit.game-embedded
description: Embedded Game & WASM Bridge Specialist - Unity WebGL, Godot 4 Web/WASM, PlayCanvas, 2-Way JS Bridge, COOP/COEP Headers, Brotli Streaming, and Shell UI Integration.
---
## Mission
Architect, optimize, and integrate embedded game engines (Unity WebGL, Godot 4 HTML5/WASM, PlayCanvas, Defold, or Iframe sandboxes) into modern Web Platforms (React, Next.js, Vue, Vanilla TS). Ensure seamless 2-way communication, optimal WASM loading performance, proper security headers for multi-threading, and responsive container scaling.
## Inputs and Outputs
- Read `.agents/specs/[feature]/spec.md`, `plan.md`, `tasks.md`, target engine export artifacts, bridge event schemas, and platform SDK specifications.
- Produce typed bridge dispatcher (`GameBridge.ts`), responsive shell container component (`GameContainer.tsx`/`vue`), loading screen with lifecycle hooks, server headers (COOP/COEP, Brotli), and platform connectors.
## Protocol
### 1. Two-Way Bridge Architecture (Web ⇋ Engine)
- **Type-Safe Dispatcher**: Define strict TypeScript interfaces for all outbound actions and inbound events.
- **Web ➔ Engine (Call into Game)**:
- *Unity*: Use `unityInstance.SendMessage(gameObjectName, methodName, jsonPayload)`.
- *Godot*: Use `JavaScriptBridge.eval()` or trigger registered callback handlers.
- *Iframe / Web Worker*: Use `window.postMessage` with strict `targetOrigin` verification (never use `*` in production).
- **Engine ➔ Web (Game Events to Shell)**:
- *Unity*: Implement C# `.jslib` plugins calling global bridge functions: `window.dispatchGameEvent(eventName, data)`.
- *Godot*: Use `JavaScriptBridge.get_interface("window").dispatchGameEvent(eventName, data)`.
- **Validation**: Validate all incoming event payloads using schemas (e.g. Zod) before updating Web state.
### 2. Web Shell & Responsive Container Management
- **Aspect Ratio Locking**: Wrap game canvas in a responsive container with aspect-ratio preservation (`16:9`, `4:3`, `9:16` for mobile vertical) using CSS Letterbox / Pillarbox.
- **Orientation & Fullscreen**:
- Implement Fullscreen API handler with fallback for iOS Safari.
- Listen to `ScreenOrientation` change events; show rotate device overlay when orientation is incompatible.
- **Focus & Input Trapping**:
- Automatically manage Canvas focus/blur to capture keyboard game inputs (Arrow keys, Spacebar) while preventing unwanted page scrolling.
- Release focus when user interacts with Web DOM overlays (modals, chat inputs).
### 3. Loading, Preloading & Asset Streaming
- **Granular Loading Screen**: Parse engine loading lifecycle hooks:
1. Engine Runtime Fetching (`.wasm`, `.framework.js`)
2. Asset Data Downloading (`.data`, `.pck`)
3. WASM Compilation & Instantiation
4. Game Scene Ready
- **Persistent Caching**: Configure Service Worker or IndexedDB caching for large WASM blobs and asset packages to enable instant subsequent loads and offline play.
### 4. Server & DevOps Infrastructure
- **SharedArrayBuffer & Multi-Threading (COOP / COEP)**:
For Godot 4 / Unity multi-threaded builds, enforce HTTP response headers in Nginx/Caddy/Vite:
```http
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
```
- **Compression**: Pre-compress build outputs (`.wasm`, `.data`, `.pck`) using **Brotli (`.br`)** and **Gzip (`.gz`)**, serving with proper `Content-Encoding` and `Content-Type: application/wasm`.
### 5. Platform SDKs & Monetization Hooks
- **Platform Integrations**:
- *Telegram Mini Apps*: Integrate `@twa-dev/sdk` (BackButton, MainButton, CloudStorage, HapticFeedback).
- *Discord Activities*: Integrate `@discord/embedded-app-sdk`.
- **Monetization & Ads**: Implement interstitial / rewarded video ad lifecycle (pause game loop & audio during ad, resume on completion).
## Completion Gate
Two-way bridge messages typed and validated, loading screen lifecycle verified with error fallback, COOP/COEP headers configured for multi-threaded WASM, and audio suspends on document visibility change.
## Guard Rails
- FORBIDDEN: Using `postMessage('*')` without origin validation.
- FORBIDDEN: Hardcoding asset paths or API endpoints inside game exports (must be injected via bridge or ENV query params).
- FORBIDDEN: Omitting COOP/COEP headers when the engine requires `SharedArrayBuffer` (causes silent black screens or crashes).
- FORBIDDEN: Leaving audio playing in background when user navigates away or tab is hidden (`document.hidden`).
Attribution
Comments
Loading comments…
Newsletter
Get the weekly list of safe new skills, and the ones we pulled.