The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates several workflow steps by executing local Python scripts using the uv runner. These scripts handle configuration resolution, decision logging (memlog), and artifact validation.
Evidence: SKILL.md executes {project-root}/_bmad/scripts/resolve_customization.py and memlog.py for environment setup.
Evidence: references/finalize.md executes scripts/recon_kit.py for citation checking and output formatting.
[EXTERNAL_DOWNLOADS]: The skill is designed to perform broad web searches using various external tools and MCP servers to gather research data.
Evidence: references/run.md describes a 'fan-out' process where research assistants use search surfaces to query the web.
Evidence: customize.toml contains configuration for external sources like Tavily, Perplexity, and xAI.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, which is an inherent vulnerability for research-focused agents.
Ingestion points: Research reports provided by the user (references/process.md) and web search results retrieved during the research loop (references/run.md).
Boundary markers: Employs a 'Research Firewall' (defined in SKILL.md) that prevents project context from being sent to subagents and utilizes 'fresh-context' verifier subagents to validate claims.
Capability inventory: The skill writes to the file system (digests, reports, logs), performs network searches via external tools, and executes local support scripts.
Sanitization: The scripts/recon_kit.py utility includes an escape-sources command that performs HTML escaping and enforces a protocol whitelist (restricting to http/https) for links in generated HTML reports.

bmad-deep-recon