The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script via uv run at the path {project-root}/_bmad/scripts/resolve_customization.py. This pattern allows the execution of arbitrary shell commands within the project environment.
[DYNAMIC_EXECUTION]: The instructions mandate the execution of entries within {agent.activation_steps_prepend}, {agent.activation_steps_append}, and the {agent.menu}. Because these fields are populated from configuration files (customize.toml and potential overrides), an attacker who can modify these files can inject and execute arbitrary commands or instructions.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface by ingesting external data into its operational context:
Ingestion points: Data is loaded from customize.toml, team overrides in _bmad/custom/, user overrides, and arbitrary files specified via persistent_facts glob patterns.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore malicious content within the ingested files.
Capability inventory: The agent possesses the capability to execute shell commands (uv run), dynamically execute activation steps, and perform file system reads.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from these external files before it is processed or executed.

bmad-cis-agent-design-thinking-coach