The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local Python scripts using uv run from the {project-root}/_bmad/scripts/ directory during activation and configuration resolution. This pattern executes code provided by the local project environment, which could be malicious if the project itself is untrusted (e.g., an unreviewed public repository or pull request).
Evidence: Run: uv run {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --project-root {project-root} --key workflow in SKILL.md.
[DYNAMIC_EXECUTION]: The skill implements an on_complete hook that executes arbitrary shell commands retrieved from the workflow.on_complete configuration key. This allows for the execution of dynamic, potentially unvalidated command strings at the end of the workflow.
Evidence: execute that value as the final terminal instruction before exiting in steps-v/step-01-validate.md and steps-e/step-02-apply-edit.md.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a story_file (markdown) to extract acceptance criteria and generate test scaffolds. This provides an attack surface where instructions embedded in the user story could influence the agent's code generation or subsequent tool use.
Ingestion points: steps-c/step-01-preflight-and-context.md reads {story_file}.
Boundary markers: The skill uses a 'Master Test Architect' persona and structured templates, but lacks explicit delimiters or warnings to ignore instructions inside the story content.
Capability inventory: uv run, write_file, playwright-cli, and directory creation tools.
Sanitization: No explicit sanitization or filtering of story content is mentioned before it is processed.
[EXTERNAL_DOWNLOADS]: The skill suggests running npx skills add to install the bmod-tea dependency from the bmad-code-org GitHub organization if it is missing. This is a vendor-owned resource used for setup purposes.
Evidence: npx skills add bmad-code-org/bmad-method-test-architecture-enterprise --skill bmod-tea in SKILL.md.

bmad-testarch-atdd