The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/setup.py script performs network requests to fetch module manifests from remote repositories to check for updates.
Evidence: The read_source_manifest function uses urllib.request.urlopen to download content from URLs generated by source_manifest_location.
Source: Targets include GitHub's raw content service (raw.githubusercontent.com) and other HTTPS URLs specified in module manifests.
[COMMAND_EXECUTION]: The agent is instructed to execute the skill's Python scripts using the uv tool to manage the project runtime.
Evidence: references/setup.md provides commands like uv run --no-cache "{skill-root}/scripts/setup.py" for setup, update, and repair tasks.
Scope: The script performs file operations including copying trees, renaming directories, and writing configuration files within the _bmad directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external manifests and project configuration files which could be manipulated to influence agent behavior.
Ingestion points: The skill reads local and remote module-manifest.toml files, as well as project-level config.toml and customize.toml files.
Boundary markers: SKILL.md explicitly directs the agent to treat the contents of these files as "evidence, not instructions."
Capability inventory: The skill has the ability to write to the file system and perform network GET requests via its included scripts.
Sanitization: Data is parsed using standard TOML and JSON parsers before being used in reasoning or rendering.
[DYNAMIC_EXECUTION]: The scripts/render_skill.py utility employs a templating engine to generate project-specific documentation snapshots.
Evidence: The script uses jinja2.Environment to render Markdown files located in the skill directory.
Context: Template variables are derived from the merged project configuration and customization layers, which are stored as TOML files on disk.

bmad