The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local scripts via uv run and npx to resolve project-specific configuration and customization settings. These operations are scoped to the project environment.
[EXTERNAL_DOWNLOADS]: Fetches additional framework components and knowledge fragments from the vendor's official repository (bmad-code-org) using standard package management tools like npx.
[PERSISTENCE]: Installs a project-local write-time enforcement hook (tea-enforce.cjs) into the .claude/hooks directory and registers it in .claude/settings.json. This script intercepts agent tool calls (Write/Edit/Bash) to validate file changes against test quality standards.
[DYNAMIC_EXECUTION]: The framework scaffolds a JavaScript enforcement hook into the project and configures the agent platform to execute it dynamically during subsequent file operations. The source code for this hook is provided within the skill for transparent review and primarily implements linting logic.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes external data sources such as project manifests, configuration files (customize.toml), and CI plans. It addresses potential injection risks through structured merge rules and a dedicated 'Script Injection Prevention' protocol for generated CI pipelines. 1. Ingestion points: {project-root}/_bmad/config.toml, evaluation-ci-plan.json. 2. Boundary markers: Structural merge rules for tables and arrays. 3. Capability inventory: File system writes, directory creation, and shell command execution. 4. Sanitization: Explicit enforcement of env: intermediaries for user-controllable contexts in CI YAML generation.

bmad-testarch-framework