The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses uv run to execute vendor-specific Python scripts (resolve_customization.py and resolve_config.py) located in the project's _bmad/scripts/ directory. These are used to resolve persona and configuration settings during the agent's activation phase.\n- [DYNAMIC_EXECUTION]: The activation workflow includes the execution of arbitrary instructions defined in activation_steps_prepend and activation_steps_append arrays within the resolved configuration. This mechanism allows the agent's startup sequence to be extended or modified by external configuration files.\n- [INDIRECT_PROMPT_INJECTION]: The agent's core instructions, including its role, identity, and principles, are merged from multiple TOML configuration files found in the project directory. This ingestion of untrusted local data represents a surface for influencing agent behavior.\n
Ingestion points: customize.toml, {project-root}/_bmad/custom/bmad-agent-dev.toml, and {project-root}/_bmad/custom/bmad-agent-dev.user.toml.\n
Boundary markers: Not present; configuration values are interpolated directly into the persona definition and workflow steps.\n
Capability inventory: The agent can read project files (via persistent_facts), execute local scripts (via uv run), and execute instruction-based activation steps.\n
Sanitization: The skill does not document any sanitization or validation of the TOML content before it is used to define the agent's behavior.

bmad-agent-dev