The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses uv run to execute scripts located within the project's own directory structure (e.g., {project-root}/_bmad/scripts/resolve_customization.py). This patterns assumes the project directory is trusted, but could be exploited if a malicious actor places scripts in that hidden directory.
[DYNAMIC_EXECUTION]: The skill dynamically resolves and executes steps defined in configuration files ({workflow.activation_steps_prepend}). While these are meant for customization, they allow arbitrary command execution at skill activation time.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process a wide variety of untrusted external data, including repository documentation, pull request templates, and user-supplied URLs to 'audit' or 'refresh' instructions.
Ingestion points: Reads AGENTS.md, files in docs/ folders, external URLs, and external_sources defined in configuration (SKILL.md Step 1 and 4).
Boundary markers: The output block uses XML-style markers (), but the input processing does not show explicit sanitization or instruction-guarding delimiters for the content it reads.
Capability inventory: Uses uv run for shell execution, reads/writes local files (AGENTS.md), and performs network operations if external URLs are supplied as sources.
Sanitization: None mentioned for processed external content before it is fanned out to subagents or used to compose new instructions.

bmad-project-context