The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external configuration files and local project files, which could contain instructions that influence the agent's behavior.
Ingestion points: The agent reads configuration from {skill-root}/customize.toml, {project-root}/_bmad/custom/{skill-name}.toml, and {project-root}/_bmad/custom/{skill-name}.user.toml. It also loads the contents of any file path or glob pattern specified in the persistent_facts array.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the loaded content as untrusted data or to ignore any embedded instructions within the facts or configuration files.
Capability inventory: The skill is capable of executing shell commands via uv run and interpreting dynamic prompts provided in the configuration.
Sanitization: The skill does not perform sanitization, validation, or escaping of the configuration data or file contents before incorporating them into the session context.
[COMMAND_EXECUTION]: The skill executes local Python scripts using the uv tool during the activation sequence.
Evidence: Scripts identified include {project-root}/_bmad/scripts/resolve_customization.py and {project-root}/_bmad/scripts/resolve_config.py. These scripts are part of the framework's internal structure.
[DYNAMIC_EXECUTION]: The skill is designed to execute instructions that are dynamically loaded from its configuration files at runtime.
Evidence: The activation logic explicitly commands the agent to "Execute each entry in {agent.activation_steps_prepend}" and {agent.activation_steps_append}. Additionally, the menu system executes the prompt text associated with selected items. This design allows the agent's core workflow to be modified via the configuration files.

bmad-agent-ux-designer