The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is instructed to execute entries in activation_steps_prepend and activation_steps_append found in the agent configuration. This configuration is merged from multiple sources including local project files, allowing for arbitrary command execution if these files are compromised.
[COMMAND_EXECUTION]: Upon activation, the skill runs a local Python script resolve_customization.py using the uv tool. The script is located within the {project-root}/_bmad/scripts/ directory, which is associated with the skill vendor's namespace.
[INDIRECT_PROMPT_INJECTION]: The skill processes configuration data from local files which can influence agent behavior and command execution.
Ingestion points: The skill reads configuration from customize.toml, {project-root}/_bmad/custom/{skill-name}.toml, {project-root}/_bmad/custom/{skill-name}.user.toml, and {project-root}/_bmad/gds/config.yaml. It also loads file content based on the persistent_facts configuration.
Boundary markers: No explicit boundary markers or instruction-ignoring delimiters are defined for the imported configuration data or facts.
Capability inventory: The skill can execute shell commands via activation_steps_prepend/append and uv run, and it can read files via the persistent_facts mechanism.
Sanitization: No sanitization or validation of the configuration entries or file content is performed before execution or ingestion into the persona context.
[DATA_EXPOSURE]: The persistent_facts configuration field allows for the loading of file contents (via file: prefixes) or globs into the agent's session context. This capability can be used to read sensitive project files if the configuration is altered by a local attacker.

gds-agent-game-architect