The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, including log files, diagnostic archives, and issue tracker tickets, which can serve as vectors for malicious instructions.
Ingestion points: The workflow in SKILL.md (Outcome 1 and Outcome 2) explicitly reads content from external issue trackers, log files, stack traces, and diagnostic archives. Additionally, Step 3 loads files matching the broad glob pattern {project-root}/**/project-context.md as foundational context.
Boundary markers: The instructions do not mandate the use of delimiters or specific "ignore" warnings when the agent or its subagents process these external data sources.
Capability inventory: The skill has the capability to write case files to the filesystem and execute shell commands (such as grep, git, and the on_complete hooks) which could be targeted by injected instructions.
Sanitization: While the {slug} used for file naming is sanitized to prevent path traversal, the actual content ingested from logs or tickets is not filtered for potential prompt injection patterns.
[COMMAND_EXECUTION]: The skill incorporates multiple mechanisms for executing shell commands and scripts defined in its configuration.
Activation scripts: During initialization, the skill executes python3 {project-root}/_bmad/scripts/resolve_customization.py to process its workflow configuration.
Configurable hooks: The customize.toml file provides fields for activation_steps_prepend, activation_steps_append, and on_complete which allow the execution of arbitrary shell commands. While these are intended for legitimate automation (e.g., repository management or notification), they represent a primary mechanism for command execution.

gds-investigate