The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts using uv run from the project's _bmad/scripts directory. It also invokes CLI tools such as git and gh to retrieve status, diffs, and pull request information.
[DYNAMIC_EXECUTION]: The workflow facilitates a "hooks" system that executes arbitrary steps defined in project-level configuration files (customize.toml and overrides). Specifically, it processes and executes entries in activation_steps_prepend, activation_steps_append, and on_complete, allowing the project environment to dynamically define agent tasks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Pull request data from gh pr view, version control diffs from git diff, and arbitrary file contents loaded through the persistent_facts configuration.
Boundary markers: The instructions do not define explicit boundary markers or "ignore instructions" delimiters for the interpolated content.
Capability inventory: The skill possesses capabilities for command execution (uv run), tool usage (git, gh), and file system access.
Sanitization: No explicit sanitization or filtering is performed on the ingested diffs or documentation files.
[PROMPT_INJECTION]: The persistent_facts feature allows project configurations to inject "foundational context" that the agent carries throughout the workflow. This mechanism could be abused to supply persistent instructions that override the skill's logic or safety guidelines.
[EXTERNAL_DOWNLOADS]: The skill utilizes the GitHub CLI to fetch remote pull request data from GitHub. This functionality targets a well-known service and is consistent with the skill's primary purpose of code review.

bmad-walkthrough