The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses uv run to execute Python scripts located within the project's directory structure ({project-root}/_bmad/scripts/). These scripts (resolve_customization.py and resolve_config.py) are invoked during the activation phase and the completion phase to handle configuration and customization logic.
[DYNAMIC_EXECUTION]: In Step 6 of the workflow, the skill resolves a value from the workflow.on_complete configuration key and instructs the agent to follow it as a "final terminal instruction." This creates a mechanism where arbitrary commands or instructions defined in project-level configuration files (customize.toml or user/team overrides) are executed by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves loading and analyzing untrusted external data from various project documents which could contain malicious instructions.
Ingestion points: The skill performs a FULL_LOAD on files matching patterns such as {planning_artifacts}/*prd*.md, *epic*.md, *architecture*.md, *ux*.md, and AGENTS.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard embedded commands or prompts within these documents.
Capability inventory: The agent has the capability to execute shell commands (uv run) and write files to the project directory.
Sanitization: No sanitization or validation of the document content is performed before it is integrated into the agent's context for impact analysis.

bmad-correct-course