The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project planning artifacts (PRD, architecture, UX/design documents) and stories.yaml to compile context and generate implementation tasks.
Ingestion points: stories.yaml in step-01-clarify-and-route.md and planning artifacts in compile-epic-context.md.
Boundary markers: Lacks explicit "ignore embedded instructions" guards when processing these documents.
Capability inventory: File system access, shell execution via uv, and subagent spawning.
Sanitization: No sanitization or filtering of external content before LLM processing.
[INDIRECT_PROMPT_INJECTION]: Subagents designed for code review are tasked with reading code diffs and specification files. These external files represent a surface where malicious instructions could be embedded to manipulate the review outcome or subsequent agent actions.
Ingestion points: {spec_file} in step-03-implement.md and {diff_file} in step-04-review.md.
Boundary markers: The implementation_handoff in customize.toml declares the spec as the "sole source of truth" without warning against embedded instructions.
Capability inventory: Write access to project files, version control operations, and autonomous subagent execution.
Sanitization: Relies on LLM reasoning without content filtering.
[COMMAND_EXECUTION]: The main skill entry point (SKILL.md) executes a project-local script (_bmad/scripts/render_skill.py) using the uv tool. While part of the intended BMad framework, this execution depends on the integrity of the files within the user's project directory.
[DYNAMIC_EXECUTION]: The skill orchestrates complex workflows by dynamically loading instructions from multiple internal markdown files (steps 1-4) and spawning several subagents for specialized tasks like planning, implementation, and multi-layer review as defined in customize.toml.

bmad-build-auto