The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill executes local Python scripts (resolve_customization.py and resolve_config.py) located within the project's _bmad/scripts/ directory using uv run. It also supports arbitrary execution steps defined in activation_steps_prepend and activation_steps_append fields within configuration files, which allows for start-up code execution based on project-local settings.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from various local sources, including persistent_facts (which can include file contents via file: glob patterns), configuration overrides from {project-root}/_bmad/custom/, and existing project documents (briefs, PRDs, etc.). The instructions do not specify explicit sanitization or boundary markers for this ingested content, creating a surface where malicious instructions in project files could influence the agent's behavior.
[COMMAND_EXECUTION]: The agent uses the npx skills add command to install additional skills when required by the user's intent or the capabilities menu. This involves shell-level operations to modify the environment.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of additional components from the bmad-code-org GitHub repository as part of its recommended capabilities and setup workflow.

bmad-agent-analyst