The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from user-uploaded transcripts, memos, decks, and web research results. This content could contain malicious instructions designed to influence or override the agent's behavior.
Ingestion points: The Discovery section involves reading various user-provided documents and subagent-generated digests from web searches. The skill also loads local project files as facts based on configuration in customize.toml.
Boundary markers: Absent. The instructions do not specify the use of protective delimiters or distinct instructions for the model to ignore embedded commands within the ingested content.
Capability inventory: The skill has significant capabilities, including executing local Python scripts via uv run, writing to the local file system (brief.md, .memlog.md), and calling external MCP tools for data retrieval and handoffs.
Sanitization: Absent. The instructions do not include steps for sanitizing or validating external content before it is used in the prompt context.
[COMMAND_EXECUTION]: The skill executes local Python scripts using the uv run command. While these scripts (resolve_customization.py, resolve_config.py, memlog.py) appear to be part of the skill framework's intended logic, this functionality demonstrates a powerful shell execution capability that could be targeted or misused.
[EXTERNAL_DOWNLOADS]: The skill spawns subagents for web research and can consult external internal tool registries or MCP tools during discovery and finalization. While these are described as organization-configured, they represent a network interaction surface for data movement.

bmad-product-brief