The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses uv run to execute local Python scripts: {project-root}/_bmad/scripts/resolve_customization.py and {project-root}/_bmad/scripts/resolve_config.py. This grants the skill the ability to run code from the project directory.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the project's local environment through its customization and configuration loading steps.\n
Ingestion points: Reads configuration from {project-root}/_bmad/custom/{skill-name}.toml and {project-root}/_bmad/custom/{skill-name}.user.toml.\n
Boundary markers: Absent; the instructions perform a deep merge of configuration without explicitly filtering or delimiting instruction content.\n
Capability inventory: The skill can execute arbitrary instructions defined in activation_steps_prepend and activation_steps_append, and can load files via persistent_facts.\n
Sanitization: Absent; the logic for merging and executing steps does not appear to sanitize input from project-local files.\n- [DATA_EXFILTRATION]: While no direct network exfiltration was found, the persistent_facts mechanism allows loading file contents into the agent's context via the file: prefix and glob patterns (e.g., file:{project-root}/**). This creates a risk of sensitive local files being exposed to the model context if broad or malicious glob patterns are configured in the project's customization files.

bmad-agent-architect