The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill scaffolds new module infrastructure by writing Python scripts (merge-config.py, merge-help-csv.py, cleanup-legacy.py) and configuration files to the user's project directory. It subsequently executes these local scripts using uv run to perform configuration merges and directory cleanups. This behavior is the intended primary purpose of the module builder.
[COMMAND_EXECUTION]: Several scripts, particularly in the scripts/tests/ directory, use subprocess.run() to execute shell commands. These are utilized for testing the scaffolding logic and running the generated scripts within a controlled test environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is designed to ingest and process untrusted data from external sources.
Ingestion points: In references/create-module.md, the agent is instructed to read all SKILL.md and customize.toml files from a user-provided directory to extract metadata, capabilities, and configuration requirements.
Boundary markers: No specific boundary markers or "ignore embedded instructions" warnings are defined for the content extracted from external skills.
Capability inventory: The skill utilizes scripts/scaffold-setup-skill.py and scripts/scaffold-standalone-module.py to write the extracted data to disk. It also executes scripts/merge-config.py and scripts/merge-help-csv.py via uv run to process the generated configuration.
Sanitization: The instructions do not specify explicit sanitization or filtering for the natural language content read from the source skills before it is interpolated into the generated module files.

bmad-module-builder