The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses uv run to execute external Python scripts, including word_metrics.py (distributed with the skill) and resolve_customization.py (expected in the project root). It also supports activation_steps_prepend, activation_steps_append, and on_complete configuration hooks that execute literal instructions provided in customize.toml or user-defined override files. This mechanism allows project-level configuration to define and execute arbitrary agent behavior.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, which is a primary surface for indirect prompt injection.
Ingestion points: The skill reads content (diffs, branches, files) and claims (commit messages) supplied by the user or project environment.
Boundary markers: The skill provides specific instructions to subagents to "Return ONLY your findings" and forbids them from invoking other skills, which serves as a security boundary.
Capability inventory: The execution environment includes shell command execution via uv run, the ability to write files to user-defined paths (report_path), and the capability to spawn subagents.
Sanitization: The skill stages content as temporary files, but there is no explicit mention of sanitizing or escaping the content to prevent instructions within the content from influencing the reviewing subagents.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive project information, including full source files, unified diffs, and test files. It can write collected findings and reports to a persistent file specified by the report_path configuration field.

bmad-review