The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to execute shell commands via uv run on scripts located in the project's local _bmad/scripts/ directory (e.g., resolve_customization.py and resolve_config.py). This creates a risk of arbitrary code execution if a malicious script is placed in that directory within an untrusted repository.
[DYNAMIC_EXECUTION]: The skill's 'run-and-heal' functionality automatically executes generated test code using npx playwright test and modifies source files to fix failures. Executing and modifying code at runtime based on AI-generated content is a significant security boundary that could be exploited.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data, including story markdown files, technical specifications, and project source code, to drive test generation. This ingestion of unverified content combined with file-writing and command-execution permissions creates an attack surface for indirect prompt injection. Ingestion points: Loads user stories ({story_file}), product requirements documents (PRDs), and technical specifications. Boundary markers: No explicit delimiters or safety instructions are used to isolate the ingested content when it is passed to subagents. Capability inventory: File system access (write_file, create_directory), repository search, and shell command execution (uv run, npx). Sanitization: The skill does not perform explicit validation or sanitization of the content extracted from story files before incorporating it into the test generation context.
[EXTERNAL_DOWNLOADS]: The skill fetches additional components and sibling skills using npx skills add from the vendor's repository (bmad-code-org/bmad-method-test-architecture-enterprise).

bmad-testarch-automate