The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes entries from deferred-work.md and reads the project codebase to verify tasks. If these files contain malicious instructions (e.g., within code comments or ledger reason fields), the agent could be manipulated during its triage process.
Ingestion points: {implementation_artifacts}/deferred-work.md, deferred-work-archive.md, and any source code files targeted for verification in SKILL.md Step 2.
Boundary markers: Ledger entries use a structured heading format (### DW-<n>:) and specific field labels (e.g., status:, reason:).
Capability inventory: Reading files, running shell commands (grep, echo, git log), writing JSON results, and invoking sub-agents for parallel verification.
Sanitization: The instructions include complex logic to verify that the Artifact only: true marker is not spoofed from fenced blocks or old artifacts, which shows some awareness of injection, but general content from the ledger or codebase is not escaped or sanitized.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands (e.g., echo, grep, git log) to check environment variables and verify code state. This is performed in an unattended automation context (BMAD_LOOP_MODE == 1) where results are validated deterministically after the session ends.
[DATA_EXPOSURE]: The skill reads several environment variables (BMAD_LOOP_LEDGER, BMAD_LOOP_RUN_DIR, etc.) and the full project codebase to perform its triage. While intended for its functionality, this broad access increases the impact of successful prompt injection attacks.

bmad-loop-sweep