The Agent Skills Directory

[COMMAND_EXECUTION]: Upon activation, the skill automatically executes local Python scripts (resolve_customization.py and resolve_config.py) using the uv run command. These scripts are targeted at the {project-root}/_bmad/scripts/ directory, making the skill dependent on the presence and safety of local project files.
[DYNAMIC_EXECUTION]: The skill is designed to execute sequences of instructions defined in configuration arrays called activation_steps_prepend and activation_steps_append. These steps are merged from multiple sources on the filesystem, including customize.toml and project-level or user-level overrides. This creates a mechanism where configuration data is treated as executable instructions during the agent's startup sequence.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant ingestion surface for untrusted data. It loads "Persistent Facts" by reading files matched by path or glob patterns from the project directory (e.g., file:{project-root}/docs/*.md). These contents are incorporated as foundational context, which could allow malicious instructions hidden in project documentation to influence the agent's persona or behavior.
Ingestion points: SKILL.md (Step 4: Load Persistent Facts) and customize.toml (persistent_facts array).
Boundary markers: None explicitly mentioned for the loaded facts.
Capability inventory: The skill can execute shell commands via uv run and dispatch to other skills like bmad-project-context.
Sanitization: No sanitization or validation of the loaded file content is described before it is treated as context.

bmad-agent-analyst