The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Python scripts found in the target repository's directory using uv run (specifically {project-root}/_bmad/scripts/resolve_customization.py and {project-root}/_bmad/scripts/resolve_config.py). This allows a malicious repository to execute code on the host machine when the skill is activated.
[COMMAND_EXECUTION]: The skill dynamically runs commands specified in the workflow.activation_steps_prepend and workflow.activation_steps_append configuration fields, which are populated from scripts resolved from the target repository.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests instructions from untrusted files such as READMEs, documentation, and manifests. Ingestion points: Files like AGENTS.md, package.json, Makefile, and CI configs in the repository being audited. Boundary markers: While it uses markers for the final output block, there are no boundary markers or instructions to ignore embedded commands for the data it scans. Capability inventory: The skill can execute shell commands via uv run and write to the filesystem. Sanitization: No evidence of content sanitization or filtering is present for external data before it influences the agent's behavior.

bmad-project-context