The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that are then presented to the agent's context. Specifically, scripts/list_customizable_skills.py scans sibling directories to extract the description field from the YAML frontmatter of SKILL.md files. This description is subsequently displayed to the user by the agent. If an attacker provides a malicious skill directory with a crafted description, it could influence the agent's behavior during the discovery phase.
Ingestion points: scripts/list_customizable_skills.py reads SKILL.md files from directories within the scanned skills roots.
Boundary markers: No specific delimiters or 'ignore' instructions are present in the script's output to encapsulate the extracted descriptions.
Capability inventory: The skill can write TOML files to the {project-root}/_bmad/custom/ directory and execute local Python scripts via uv run.
Sanitization: The discovery script uses json.dumps() to structure the output, but the content of the description field is not sanitized for potential injection patterns.
[COMMAND_EXECUTION]: The skill uses uv run to execute local scripts (list_customizable_skills.py) and framework-provided scripts (resolve_customization.py). While these are part of the skill's intended functionality for managing the BMad environment, they represent a capability to execute code on the host system within the project's scope.

bmad-customize