The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes uv run to execute scripts located at {project-root}/_bmad/scripts/resolve_customization.py and {project-root}/_bmad/scripts/resolve_config.py. This executes code directly from the project being analyzed, which is a major security risk when interacting with untrusted repositories.
[DYNAMIC_EXECUTION]: The skill is configured to execute arbitrary command strings defined in activation_steps_prepend and activation_steps_append. These steps are resolved from configuration files (like _bmad/custom/bmad-project-context.toml) that are provided by the target project, effectively allowing the repository to inject and execute commands during the skill's activation phase.
[REMOTE_CODE_EXECUTION]: By design, the skill's activation workflow involves running Python scripts from the project's root folder. This pattern allows a repository author to achieve automatic code execution on a user's machine whenever an agent skill is activated to audit or setup that repository.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface as it processes various untrusted files from the target repository to generate agent instructions.
Ingestion points: Reads AGENTS.md, repository documentation, package.json, Makefile, pyproject.toml, and user-provided external_sources (which can be external URLs).
Boundary markers: Uses  markers to delimit the managed block within the instruction file.
Capability inventory: The agent has the capability to execute shell commands (via uv run) and write to files on the local system.
Sanitization: The skill performs path-checking for named files, but there is no explicit sanitization or filtering mentioned for prose content or data retrieved from external URLs before it is processed or used in decisions.

bmad-project-context