The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from architecture and PRD documents provided by the user (found in SKILL.md, init.md, and requirements.md). Ingestion points: The architecture_doc_path and prd_path variables point to external files analyzed during the workflow. Capability inventory: The skill can execute shell commands via uv run (found in SKILL.md, init.md, coverage.md, integrations.md, requirements.md, synthesize.md, and report.md) and write files via atomicWriteHelper. Boundary markers: The coverage-patterns.md indicates that technology detection skips fenced code blocks to avoid misinterpreting diagrams or commands. Sanitization: The skill employs deterministic Python scripts to parse content and uses parallel subagents with strict JSON return schemas (in integrations.md) to isolate the processing of other skills' documentation, significantly reducing the risk of malicious instructions influencing the main agent's execution.
[COMMAND_EXECUTION]: The skill frequently uses the uv run command to execute local Python scripts for data processing, tallying, and report generation. These scripts are located within the project's internal structure (scripts/, shared/scripts/, _bmad/scripts/) and are essential for the skill's deterministic analysis.
[DYNAMIC_EXECUTION]: The skill uses Python's importlib to dynamically load a shared validation script (skf-validate-feasibility-report.py) in skf-previous-report.py, skf-report-delta.py, and skf-verdict-rollup.py. This is used to ensure consistent parsing of the feasibility reports across different stages of the workflow and targets a specific file within the skill's expected installation environment.

skf-verify-stack