The Agent Skills Directory

[COMMAND_EXECUTION]: The main entry point in SKILL.md instructs the agent to execute a shell command: uv run --no-cache "{project-root}/_bmad/scripts/render_skill.py". This involves executing code within the local shell environment.
[DYNAMIC_EXECUTION]: The script being executed (_bmad/scripts/render_skill.py) is located within the user's project root. This pattern executes code sourced from the repository being audited; if an attacker-controlled repository contains a malicious script at this path, the agent will execute it during the build loop.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted planning artifacts to derive implementation tasks and verification steps.
Ingestion points: step-01-clarify-and-route.md reads files from the planning artifacts directory (e.g., PRD, architecture, UX/design files) and the epics file.
Boundary markers: While spec-template.md uses an <intent-contract> tag, there are no explicit instructions to the agent to ignore or sanitize embedded instructions within the ingested planning documents.
Capability inventory: The agent has the capability to write files, execute shell commands (for verification in step-03), and spawn subagents.
Sanitization: No sanitization or escaping of the external planning content is performed before interpolation into specs.
[EXTERNAL_DOWNLOADS]: The module-manifest.toml references a remote update source at github:bmad-code-org/BMAD-METHOD/skills. This is a vendor-owned resource used for skill updates.

bmad-build-auto