The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes local scripts and platform-specific commands. It uses uv run to invoke Python utilities (resolve_customization.py, resolve_config.py, memlog.py, brain.py) located in both the skill's root and the project's _bmad folder. It also uses system commands (open, xdg-open, start) to launch a generated HTML file in the user's browser.
[DYNAMIC_EXECUTION]: The instructions for the agent include shell commands that interpolate user-provided data directly into arguments. For example, in SKILL.md, the agent is told to run uv run ... --field topic="<topic>" and uv run ... --text "<one-line gist>". Because these commands incorporate untrusted user-supplied strings (topic, goal, session summaries) into a shell context without explicit escaping requirements, they present a risk of command injection if the agent executes them via a standard shell.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection. It is configured to ingest foundational context from project files using user-defined globs (persistent_facts in customize.toml). It also reads session history from .memlog.md and custom technique definitions from JSON files (additional_techniques). The instructions do not specify the use of boundary markers or sanitization when processing these external data sources, potentially allowing embedded instructions in project files to influence agent behavior.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install components from the bmad-code-org/BMAD-METHOD repository on GitHub using npx skills add. These references target the vendor's official infrastructure for framework setup.

bmad-brainstorming