The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script located at {project-root}/_bmad/scripts/resolve_customization.py using uv run during the activation process. It also executes instructions defined in activation_steps_prepend and activation_steps_append configuration fields.
[DYNAMIC_EXECUTION]: The agent is instructed to dynamically execute steps and prompts loaded from configuration variables, allowing for runtime instruction generation from external files.
[INDIRECT_PROMPT_INJECTION]: The skill's persona, identity, and foundational context are derived from external configuration files (customize.toml, config.yaml, and project-specific .toml files) located in the project directory.
Ingestion points: Configuration is loaded from {project-root}/_bmad/custom/, {project-root}/_bmad/gds/config.yaml, and file paths defined in agent.persistent_facts.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded malicious commands within these ingested files.
Capability inventory: The skill has the ability to execute shell commands, run local Python scripts, and read local files into the LLM context.
Sanitization: There is no evidence of validation or sanitization of the configuration data before it is used to drive agent behavior.
[DATA_EXFILTRATION]: The agent.persistent_facts mechanism allows for loading the contents of arbitrary files from the filesystem (using the file: prefix) into the agent's context, which could be abused to expose sensitive information if configuration files are compromised.

gds-agent-game-solo-dev