The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill executes a Python script at {project-root}/_bmad/scripts/resolve_customization.py during activation. This script is used to merge configuration files (customize.toml, .toml overrides) and its execution is mandatory for the skill to function.
[COMMAND_EXECUTION]: The activation process involves executing steps defined in {agent.activation_steps_prepend} and {agent.activation_steps_append}. If these configuration fields, which are sourced from project-level files, contain malicious shell commands, they would be executed by the agent during the skill's startup phase.
[INDIRECT_PROMPT_INJECTION]: The skill loads 'Persistent Facts' from external files (file: paths under {project-root}) and renders them into the foundational context. It also ingests user-controlled configuration like {user_name} and {agent.role} directly into its persona and greeting without explicit sanitization or boundary markers, creating a surface for prompt injection from data files.
[SAFE]: The skill references other internal skills such as gds-quick-dev, gds-code-review, and bmad-advanced-elicitation via its menu system, which is standard behavior for an agent hub or persona skill.

gds-agent-game-solo-dev