The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands for git diff, git log, and gh pr view by directly interpolating user-supplied or project-derived strings such as branch names, commit ranges, and file paths. Because these inputs are not sanitized before execution, they present a surface for command injection if an attacker provides a string containing shell metacharacters.
[DYNAMIC_EXECUTION]: Upon completion of the review, the skill resolves an on_complete field from the project's configuration files (e.g., _bmad/custom/bmad-code-review.toml) and instructs the agent to execute the resulting string as a terminal command. This allows the project environment to trigger arbitrary command execution at the end of the workflow.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from repository files.
Ingestion points: Content is loaded from unified diffs, commit messages, and external specification files into the agent's context.
Boundary markers: Prompts for subagents use simple labels like CONTENT: but do not employ robust delimiters or explicit instructions to disregard embedded commands.
Capability inventory: The agent possesses shell command (git, uv, gh) and file-write capabilities.
Sanitization: No validation or sanitization is performed on the ingested content before it is processed by subagents.
[COMMAND_EXECUTION]: The workflow relies on executing local Python scripts within the project's _bmad/scripts/ directory via uv run. This represents a vendor-specific integration with the 'bmad' framework, but it effectively grants execution privileges to scripts located within the codebase being reviewed.

bmad-code-review