The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run() in scripts/eval_common.py, scripts/run_evals.py, and scripts/run_triggers.py to execute the agent harness command and helper scripts.
[COMMAND_EXECUTION]: In scripts/eval_common.py, the resolve_harness function executes a configuration resolver script (resolve_customization.py) located within the project's _bmad/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from evaluation case files (cases.json) and trigger query files (triggers.json) which are interpolated into the inputs sent to the agent harness. This is the intended behavior for an evaluation tool.
[SAFE_PRACTICE]: The skill implements a 'clean room' pattern using tempfile.TemporaryDirectory and build_case_env to isolate evaluations from the host environment, specifically scrubbing environment variables to prevent credential leakage.

bmad-eval