The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses uv run to execute internal Python scripts (resolve_config.py, read_toml.py, tickets.py) for processing configuration and ticket data. It also leverages standard, well-known developer CLI tools—such as the GitHub CLI (gh), Jira CLI (acli), and various Model Context Protocol (MCP) servers—to synchronize ticket status with external platforms.
[EXTERNAL_DOWNLOADS]: The skill's setup instructions include a step to install the bmad base skill using npx from the author's GitHub organization (bmad-code-org) if it is not already available in the environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process ticket data (titles, descriptions, and comments) from external sources, which constitutes a potential attack surface for indirect prompt injection.
Ingestion points: Data is retrieved from external trackers using the query verbs defined in the store configuration files (e.g., executing gh issue view or acli jira workitem view).
Boundary markers: The skill uses markdown headers and frontmatter to separate user-provided content from metadata and instructions.
Capability inventory: The skill can write files to the local filesystem (creating ticket markdown files) and execute shell commands via uv run and standard CLI tools.
Sanitization: The skill employs tomllib for safe TOML parsing and a custom frontmatter parser that handles specific key-value pairs and inline lists, reducing the risk of processing arbitrary YAML.

bmad-preview-ticketing