The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow instructions in SKILL.md (Steps 2, 6, and the final action in Step 10) direct the agent to execute arbitrary steps defined in configuration files such as customize.toml and project-specific overrides. These activation steps (activation_steps_prepend and activation_steps_append) allow for the execution of commands within the agent's environment.
[DYNAMIC_EXECUTION]: Step 10 of the workflow involves running a Python script to resolve the 'workflow.on_complete' key and instructs the agent to follow the resulting output as a 'final terminal instruction'. This pattern of executing dynamically retrieved instructions presents a risk if the configuration source is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external files specified in 'persistent_facts' and provided as context during invocation, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Data is loaded from files matching glob patterns or specific paths in the project root as defined in the 'persistent_facts' configuration field in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the content of these files as data only or to ignore any embedded commands.
Capability inventory: The agent possesses file system write access (writing to the default_output_file) and command execution capabilities (via uv run).
Sanitization: The skill lacks mechanisms to sanitize or validate the content of the loaded files before it is used in the storytelling workflow or interpolated into templates.

bmad-cis-storytelling