The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to load and execute workflow instructions (activation_steps_prepend, activation_steps_append, on_complete) and context (persistent_facts) from the project's own directory ({project-root}/_bmad/custom/). This allows a malicious repository to provide its own instructions that the agent will follow as foundational context or terminal actions.
Ingestion points: SKILL.md (Step 1, Step 3, and On Complete). It reads {project-root}/_bmad/custom/{skill-name}.toml and related user files.
Boundary markers: Absent. The skill instructs the agent to treat these external entries as "foundational context" or steps to "execute in order" without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill possesses the ability to execute shell commands (uv run), read/write files throughout the project, and perform web searches to identify test frameworks.
Sanitization: Absent. There is no validation or filtering of the natural language instructions loaded from these external configuration files.
[COMMAND_EXECUTION]: The skill uses uv run to execute Python scripts located within the project being analyzed ({project-root}/_bmad/scripts/resolve_customization.py and resolve_config.py). This grants code within the target project the ability to run during the skill's setup phase.

bmad-qa-generate-e2e-tests