The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/tickets.py uses importlib.util to dynamically load a configuration utility (config_utils.py) from a path computed at runtime based on the project root ({project-root}/_bmad/scripts/). This allows the execution of arbitrary Python code if the project structure is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted external sources, including remote ticketing systems (GitHub Issues, Jira, Linear, Notion, Trello) and local specification documents.
Ingestion points: Data is fetched via CLI tools and MCP servers (e.g., gh issue view, acli jira workitem view, get_issue, notion-fetch) and from local markdown files in the {active_initiative} directory.
Boundary markers: The instructions lack mandatory delimiters or explicit warnings to the agent regarding the presence of embedded instructions in external data.
Capability inventory: The skill can write files (markdown, TOML), execute local scripts via uv run, and perform network operations via tracker CLIs.
Sanitization: No explicit sanitization or filtering of external content is described before interpolation into agent prompts.
[COMMAND_EXECUTION]: The test suite (scripts/tests/test_read_toml.py and scripts/tests/test_tickets.py) uses subprocess.run to execute the skill's main logic scripts via the Python interpreter. This is a standard practice for functional testing but represents a command execution vector.

bmad-ticket