The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to run a local Python script (resolve_customization.py) from the project's _bmad/scripts/ directory using uv run. This script is used to determine configuration overrides during activation and after completion of the workflow.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the project's filesystem, creating a surface for indirect prompt injection.
Ingestion points: Data is loaded from {project-root}/_bmad/gds/config.yaml, {project-root}/_bmad/custom/{skill-name}.toml, and various files matched by globs in persistent_facts.
Boundary markers: The instructions lack specific delimiters or warnings to prevent the agent from following instructions embedded within these external files.
Capability inventory: The skill can write multiple infrastructure files (e.g., .cs, .h, .gd) and execute shell commands (uv run).
Sanitization: No sanitization or validation logic is defined for the ingested data before it is interpolated into code templates or used to drive the workflow.
[DATA_EXFILTRATION]: The skill accesses the project's config.yaml file to retrieve the user_name and communication_language. While this is used for personalization within the skill's greeting, it constitutes access to project configuration data.

gds-e2e-scaffold