The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's activation sequence involves executing a Python script located within the local project directory at {project-root}/_bmad/scripts/resolve_customization.py. Additionally, the skill implements an on_complete hook, which allows for the execution of arbitrary shell commands defined in the project's customize.toml or config.yaml files.
[REMOTE_CODE_EXECUTION]: The workflow dynamically resolves and executes numerous helper scripts, such as skf-scan-manifests.py and skf-detect-language.py, by searching for them within the project's own directory structure ({project-root}/_bmad/skf/shared/scripts/). This allows an untrusted project to provide malicious scripts that will be executed by the agent using uv run.
[DYNAMIC_EXECUTION]: The on_complete hook provides a mechanism for dynamic command execution, where the command to be run is determined at runtime based on potentially untrusted configuration files found in the project being analyzed.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes large volumes of untrusted data, including external source code, package manifests, and documentation URLs, to generate skill briefs. This creates a significant attack surface for indirect prompt injection, as malicious instructions embedded in these external resources could be used to manipulate the agent's analysis or subsequent actions.

skf-analyze-source