The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script using uv run at {project-root}/_bmad/scripts/resolve_customization.py for configuration resolution and post-completion hooks. It also supports executing command sequences defined in configuration fields like activation_steps_prepend and activation_steps_append. As these scripts and paths are aligned with the skill vendor's own directory structure (_bmad), they are documented as intended functionality.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project files—such as architecture documents, engine-specific configurations (Unity, Unreal, Godot), and source code—to automatically discover implementation patterns. This data ingestion establishes a surface for indirect prompt injection.
Ingestion points: Analyzes project-root files, game architecture documents, and engine manifests in steps/step-01-discover.md.
Boundary markers: The skill functions as a facilitator, presenting discovery findings to the user and requiring confirmation (A/P/C menu) before saving content, providing a manual control gate.
Capability inventory: Local script execution via uv run and file-writing capabilities to generate the output document.
Sanitization: The skill does not explicitly validate or sanitize the textual content extracted from project files before it is processed by the agent context.

gds-generate-project-context