The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a Python script located at '{project-root}/_bmad/scripts/resolve_customization.py' to handle configuration merging. This allows the project repository being audited or worked on to provide executable code that the agent runs locally.
[REMOTE_CODE_EXECUTION]: In 'step-auto-finalize.md', the agent is instructed to execute all commands listed in the 'Verification' section of the specification file it previously generated. Because the specification is created from potentially untrusted user intent or feedback files, this creates a direct path for arbitrary command execution.
[DATA_EXFILTRATION]: The automation logic writes result and escalation data to file paths defined by environment variables '$BMAD_AUTO_RUN_DIR' and '$BMAD_AUTO_TASK_ID'. This allows the agent to write data to arbitrary locations on the file system if these variables are manipulated.
[PROMPT_INJECTION]: The skill ingests intent from external sources including user prompts, feedback files, and deferred-work bundles. While 'step-01-clarify-and-route.md' contains instructions to ignore directives that attempt to skip workflow steps, the agent still proceeds to perform sensitive actions like code modification and command execution based on this input.
[PROMPT_INJECTION]: Ingestion points: 'automation-mode.md' (invocation args, feedback files, bundle files) and 'step-01-clarify-and-route.md' (user intent). Boundary markers: Explicit instructions in 'step-01' to ignore directives within intent that bypass steps. Capability inventory: File writing, execution of project-local Python scripts, and execution of arbitrary shell commands. Sanitization: Absent; the system relies on LLM reasoning and the 'frozen-after-approval' intent block logic.

bmad-auto-dev