The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is instructed to execute arbitrary entries found in the activation_steps_prepend and activation_steps_append configuration arrays. These steps are loaded from customize.toml and potential overrides in the project root (_bmad/custom/). If these configuration files are modified by an attacker, they can trigger the execution of malicious instructions or shell commands during the agent's initialization phase.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad ingestion surface for untrusted data. It merges configuration from multiple sources and loads the contents of files specified in the persistent_facts array (including glob patterns). These inputs are directly interpolated into the agent's core persona, principles, and foundational context without sanitization or explicit boundary markers, allowing for instructions embedded in project files to hijack the agent's behavior.
[COMMAND_EXECUTION]: The skill explicitly executes local Python scripts using uv run (e.g., resolve_customization.py and resolve_config.py). While these are part of the framework's infrastructure, the reliance on scripts located within the {project-root} means that if an attacker can write to the _bmad/scripts/ directory, they can achieve arbitrary code execution when the skill is activated.

bmad-agent-ux-designer