The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection. It ingests untrusted data from external sources including requirement documents (PRDs), design specifications, and issue data from remote trackers (GitHub, Jira, Linear, Notion, Trello). This data is processed in SKILL.md and references/slice.md to facilitate the creation and refinement of tickets. The skill has the capability to write markdown files and execute local Python scripts using uv run. While the skill includes instructions for self-review and user confirmation, there is no technical sanitization layer for external content before it is processed by the agent or interpolated into ticket templates.
Ingestion points: Reads project intent from intent.md, PRDs, and briefs (specified in SKILL.md); queries remote state from trackers via CLI tools (specified in references/board.md).
Boundary markers: Uses markdown headers and frontmatter to structure data, but lacks explicit delimiters or instructions to ignore embedded commands in the ingested requirement sources.
Capability inventory: Executes local scripts (resolve_config.py, read_toml.py, tickets.py) via uv run (specified in SKILL.md); writes and modifies markdown files in the local ticket tree (specified in references/board.md and scripts/tickets.py).
Sanitization: No evidence of automated sanitization or escaping of external content in the provided Python scripts or instructions.
[COMMAND_EXECUTION]: The skill workflow relies on the execution of several local Python scripts via the uv run command. These scripts (resolve_config.py, resolve_customization.py, read_toml.py, and tickets.py) are used to manage project configuration, customization, and ticket state. The command parameters are often derived from the local environment (e.g., {project-root}) or user-supplied ticket folders.

bmad-preview-ticketing