The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill automatically executes a Python script from the target project root during the initialization phase (uv run {project-root}/_bmad/scripts/resolve_customization.py). This is a severe security risk because {project-root} is untrusted content provided by the user (the subject of the review). A malicious repository can include an arbitrary script at this path that will be executed with the agent's permissions.
[COMMAND_EXECUTION]: The customize.toml configuration file contains fields such as activation_steps_prepend, activation_steps_append, and on_complete which are defined as 'literal instructions' or 'freeform directives'. These instructions are executed by the agent as part of the skill workflow. Because these fields can be influenced by the resolve_customization.py script or project-level configuration overrides, they represent a vector for command and instruction injection.
[DYNAMIC_EXECUTION]: The skill relies on dynamic loading and execution of instructions from both its own configuration and potentially from the project it is auditing. The uv run pattern is used both for its own internal scripts and for external project scripts, blurring the boundary between the skill's trusted code and the untrusted project data.
[INDIRECT_PROMPT_INJECTION]: The core functionality of the skill involves processing untrusted external content (diffs, specifications, and 'claims' files). The 'Adversarial Lens' is specifically instructed to 'Find at least ten issues to fix or improve' and to 're-check and keep thinking' if zero are found. This instruction could be exploited by malicious input content to force the agent into generating false findings or to bypass security logic by distracting the model with forced analysis steps.

bmad-review