The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts using the uv package runner. It runs word_metrics.py, which is included in the skill, and resolve_customization.py, which is part of the vendor framework located in the project's _bmad/scripts/ directory.
[COMMAND_EXECUTION]: The skill performs dynamic instruction execution based on the activation_steps_prepend and activation_steps_append fields in the customize.toml configuration file during the activation process.
[DATA_EXFILTRATION]: The skill is configured to automatically read project context information from files matching the pattern {project-root}/**/project-context.md to use as standing context for the agent.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes user-provided document content while being explicitly instructed to treat the content as "sacrosanct" and "never challenge ideas."
Ingestion points: User-provided document content (pasted or via file path) and project context files.
Boundary markers: None identified; document content is processed directly without explicit isolation delimiters.
Capability inventory: Execution of Python scripts via uv run and execution of activation steps.
Sanitization: None present; the skill instructions prioritize preserving the input content's voice and ideas over defensive sanitization.

bmad-editorial-review