The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data, specifically project source code, unified diffs, and specification files, which are passed to subagents for implementation and review. This creates a risk where malicious instructions embedded in the project files could influence the subagent's behavior. Ingestion points: Specification files in step-03-implement.md and unified diffs in step-04-review.md. Boundary markers: Absent. While the prompts specify the content to be reviewed, they do not use strong delimiters or explicit instructions to ignore commands embedded within the reviewed code or diffs. Capability inventory: The skill can execute shell commands, read/write files, and spawn subagents. Sanitization: No evidence of sanitization or filtering of the processed content before it is included in prompts.
[COMMAND_EXECUTION]: The bootstrap instruction in SKILL.md directs the agent to execute a Python script located within the project's own directory structure. Evidence: uv run --no-cache "{project-root}/_bmad/scripts/render_skill.py" ... Context: While this is part of the tool's intended setup and operation, executing code from a project directory that may contain untrusted files is a known risk vector.

bmad-build