The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a Python script located at {project-root}/_bmad/scripts/render_skill.py using uv run. Since this script resides within the project being reviewed rather than the skill's own directory, it presents a risk if the skill is executed against an untrusted or malicious repository that has modified this file.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of unified diffs from the local repository. This content is passed to several subagents (blind-hunter, edge-case-hunter, verification-gap) to generate review findings and suggested fixes. Maliciously crafted code or comments in the diff could attempt to manipulate subagent behavior or influence the triage process.
Ingestion points: step-01-gather-context.md writes the diff to a temporary file {diff_file}.
Boundary markers: Subagent prompts in customize.toml attempt to delimit the content (e.g., CONTENT: the unified diff at {diff_file}).
Capability inventory: The workflow can apply suggested patches to the filesystem in step-04-present.md and execute shell commands.
Sanitization: There is no explicit sanitization of the diff content; the system relies on the model's adherence to the 'context-free' subagent instructions.
[DYNAMIC_EXECUTION]: The workflow architecture dynamically loads and renders instruction files (e.g., step-01-gather-context.md, workflow.md) using a template-based system. It also supports a configurable on_complete instruction in customize.toml that is executed at the end of the review process.

bmad-code-review