The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes several shell commands including uv run to execute project-local scripts, and git and gh for context gathering. It also suggests using npx to install the 'bmad' skill framework if it is missing.
[DYNAMIC_EXECUTION]: The skill's architecture relies on dynamically rendering and following step files. Specifically, it executes render_skill.py from a path determined at runtime within the project's root directory (_bmad/scripts/), which could allow a malicious repository to execute arbitrary code during the review process.
[EXTERNAL_DOWNLOADS]: The skill instructions include a command to install the bmad framework from the vendor's GitHub repository (bmad-code-org/BMAD-METHOD) using npx. This resource belongs to the skill's official author.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as code diffs and PR descriptions as input for review subagents.
Ingestion points: Reads project diffs, claims files, and plan documents from the local environment or via gh pr view.
Boundary markers: Prompt templates for subagents use structural markers and explicit instruction headers to delimit content.
Capability inventory: The main agent has command execution and file access capabilities, while subagents are explicitly restricted from invoking additional skills.
Sanitization: A mandatory triage step requires the main agent to verify subagent findings against the codebase before presenting them to the user.

bmad-code-review