The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute a Python script located at {project-root}/_bmad/scripts/resolve_customization.py during the activation and completion steps. This allows for the execution of arbitrary code stored within the working directory, which poses a significant risk if the project being developed is untrusted or contains malicious scripts.\n- [COMMAND_EXECUTION]: The workflow performs several shell operations, including git rev-parse HEAD and the execution of project tests. The automated determination and execution of tests based on the project structure (Step 7) can be exploited to run malicious shell scripts defined in project metadata or configuration files.\n- [DYNAMIC_EXECUTION]: The skill dynamically resolves and executes customization logic from scripts and configuration files stored within the project environment (e.g., _bmad/scripts and _bmad/custom). This pattern of loading and executing code from the workspace is a potential vector for unauthorized action if the workspace files are malicious.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its reliance on project-controlled files:\n
Ingestion points: Content is read from {project-root}/_bmad/gds/config.yaml, sprint-status.yaml, project-context.md, and individual story implementation files.\n
Boundary markers: The instructions do not define clear delimiters or include warnings to ignore instructions embedded within these data sources.\n
Capability inventory: The agent has the ability to execute shell commands, run scripts, and modify project files.\n
Sanitization: No sanitization or validation is applied to the data read from these files before it is used to influence the agent's implementation decisions and workflow execution.

gds-dev-story