The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes git commands to discover project changes and verify story claims. This is a primary function for its role as a code reviewer.
Evidence: Runs git status --porcelain, git diff --name-only, and git diff --cached --name-only in instructions.xml (Step 1).
[INDIRECT_PROMPT_INJECTION]: The skill reads and processes external source code and story requirement files, which could contain malicious instructions designed to influence the agent's review outcome or automated fixing behavior.
Ingestion points: Reads story files from {{story_path}}, project context from {project_context}, and all files listed in the project's git history (instructions.xml).
Boundary markers: The skill uses a structured XML workflow (instructions.xml) and a checklist (checklist.md) to guide the agent, but lacks explicit "ignore instructions in data" delimiters for the code it reviews.
Capability inventory: The skill can write/modify source code files (action: Fix all HIGH and MEDIUM issues), update story files, and modify sprint-status.yaml (instructions.xml Steps 4 and 5).
Sanitization: No explicit sanitization or escaping of the content read from external files is mentioned before the agent processes it for review.
[SAFE]: The skill includes explicit safety exclusions to prevent it from modifying or leaking internal agent configuration folders.
Evidence: instructions.xml explicitly excludes _bmad/, _bmad-output/, .cursor/, and .windsurf/ folders from the review process.

bmad-story-automator-review