The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script {project-root}/_bmad/scripts/render_skill.py using the uv tool. This script is responsible for rendering the review workflow and is a standard part of the BMAD methodology setup.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to process external data such as code files, PR descriptions, and commit messages, which creates a surface for indirect prompt injection.
Ingestion points: Instructions in step-01-orientation.md direct the agent to read initiative tickets, PR descriptions, and commit messages from the project directory.
Boundary markers: There are no explicit delimiters or boundary markers defined in the prompt templates to isolate external data from the agent's instructions.
Capability inventory: The agent has the ability to execute commands via uv, read project files, and write new directories and files (narratives and logs).
Sanitization: The templates do not contain instructions for sanitizing or escaping the content retrieved from external files before processing.
[EXTERNAL_DOWNLOADS]: If the required local scripts are not found, the skill suggests installing the bmad skill from the vendor repository bmad-code-org/BMAD-METHOD. This is an expected reference to the framework's own components.

bmad-walkthrough