The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes uv run to execute a script located at {project-root}/_bmad/scripts/resolve_customization.py. Since the project root is an external and potentially untrusted directory provided by the user, this allows the target project to execute arbitrary commands during the documentation process.
[REMOTE_CODE_EXECUTION]: The activation and completion steps in SKILL.md and instructions.md explicitly trigger the execution of code residing within the project being documented. A malicious repository could exploit this to run harmful code as soon as the documentation workflow is initiated.
[INDIRECT_PROMPT_INJECTION]: The skill performs exhaustive scans of all source code files in a project (as seen in deep-dive-instructions.md Step 13b). Reading untrusted code directly into the agent's context without sanitization or boundary markers allows for indirect prompt injection attacks if the codebase contains instructions designed to override the agent's behavior.
Ingestion points: All project source files defined by critical directories or recursive scans in full-scan-instructions.md and deep-dive-instructions.md.
Boundary markers: None; the instructions require the agent to read 'every line of every file' and store it in an inventory.
Capability inventory: Shell command execution (uv run) and local file system writes.
Sanitization: None; the skill ingests raw file content directly into the agent's working memory for analysis.

gds-document-project