The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is configured to execute arbitrary instruction sequences defined in the customize.toml file under the activation_steps_prepend, activation_steps_append, and on_complete keys. This allows for the execution of unvalidated commands at multiple stages of the skill's operation.
[COMMAND_EXECUTION]: The scripts/resolve_personas.py script uses the subprocess.run function to execute other Python scripts (resolve_config.py and resolve_customization.py). The paths to these scripts are dynamically constructed relative to the project root, which is a significant capability for running external logic.
[INDIRECT_PROMPT_INJECTION]: The skill ingests 'project files and materials' to validate user claims and drive the forge process. This untrusted data enters the agent's context and influences reasoning and script-based state updates (via memlog.py), creating a potential injection surface.
Ingestion points: The 'Discover intent' and 'The forge' sections in SKILL.md describe reading external project materials.
Boundary markers: The instructions do not define specific delimiters or security headers to isolate content from these external files.
Capability inventory: The skill has the ability to write files (forged-idea.md, forge-report.html), maintain state via a local database script (memlog.py), and execute shell commands.
Sanitization: There is no evidence of content validation or escaping for the data ingested from project materials before it is processed by the agent.

bmad-forge-idea