The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using uv run to invoke internal scripts like memlog.py. The --text parameter in these calls is populated directly from user-provided input (transcripts, emails, Slack threads). This creates a high risk of command injection if the input contains shell metacharacters or unbalanced quotes intended to break out of the command string.
[DYNAMIC_EXECUTION]: The skill's activation logic includes running steps defined in the activation_steps_prepend, activation_steps_append, and on_complete configuration fields from customize.toml. Since these fields can be overridden by project-specific or user-specific configuration files, it enables arbitrary command execution within the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external sources like meeting transcripts and customer emails to generate formal specifications.
Ingestion points: SKILL.md describes the ingestion of "mixed multi-source" intent input.
Boundary markers: There are no explicit markers or instructions provided to the agent to ignore embedded commands or instructions within the external data.
Capability inventory: The skill possesses capabilities to write files to the project directory and execute shell commands via the uv toolchain.
Sanitization: No sanitization or validation of the input data is performed before it is logged or processed by the underlying scripts.

bmad-spec