The Agent Skills Directory

[PROMPT_INJECTION]: The orchestrator implements a workflow where project-specific context and task definitions are read and injected into sub-agent prompts, creating a surface for indirect prompt injection. ● Ingestion points: Reads various project files including sprint-status.yaml, epics.md, and tech-spec-*.md in SKILL.md. ● Boundary markers: Content is enclosed in XML-like tags, providing basic structural separation. ● Capability inventory: Sub-agents have significant system capabilities, including package installation and shell execution. ● Sanitization: No specific content sanitization or instruction-bypass filtering is applied to the ingested data.
[EXTERNAL_DOWNLOADS]: The functional validation guides recommend downloading and running various third-party tools and Docker images from well-known services and trusted organizations. ● Fetches tools and configurations from trusted vendors including Vercel Labs, HashiCorp, and Cloudflare. ● Utilizes official Docker images for security scanning, linting, and environment simulation (e.g., semgrep, hadolint, terraform).
[COMMAND_EXECUTION]: The workflow involves executing build and test commands across various tech stacks. ● Instructs sub-agents to perform package installation (npm, pip, cargo) and run validation suites (pytest, playwright, terraform validate). ● Leverages vendor-specific skills from bmad-labs to handle specialized implementation steps.

bmad-auto