The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its architecture of ingesting external data to drive autonomous decisions.
Ingestion points: The workflow in step-01-clarify-and-route.md and step-02-plan.md loads stories.yaml, epic specification files, and planning artifacts (e.g., PRDs, architecture, and UX documents). Additionally, step-04-review.md processes code diffs and narrative claims.
Boundary markers: The skill uses structural tags like <intent-contract> and explicit natural language instructions (e.g., in step-03-implement.md and references/claims-check.md) to limit the agent's attention to specific sections of ingested files.
Capability inventory: The agent can execute shell commands through the uv run command in SKILL.md and manage repository state via Git. It also orchestrates subagents that have the capability to modify source code and run project-specific verification checks.
Sanitization: The skill relies on formatting and context isolation rather than programmatic sanitization or escaping of external inputs before they are included in prompts for reviewer or implementer subagents.
[COMMAND_EXECUTION]: The primary instruction in SKILL.md directs the execution of a shell command (uv run --no-cache "{project-root}/_bmad/scripts/render_skill.py"). This allows the agent to execute a Python script located within the user's project directory.

bmad-build-auto