The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute specific Python scripts located within the project's internal directory structure ({project-root}/_bmad/scripts/) using the uv tool. These scripts, including resolve_customization.py, resolve_config.py, and memlog.py, are used for core workflow functions such as resolving project configurations and maintaining an audit trail of design decisions.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting external data sources such as Product Requirement Documents (PRDs), Figma exports, and user-provided sketches. This creates a surface for indirect prompt injection; however, the skill mitigates this through a structured 'Discovery' process that emphasizes capturing user intent over autonomous authoring and includes manual 'Finalize' checkpoints.
[EXTERNAL_DOWNLOADS]: The skill references several well-known and trusted external services and repositories, including Google Labs' design.md specification, Google Stitch, and Excalidraw. These are used as reference standards or optional handoff targets and do not involve the automated execution of unverified remote code.
[DYNAMIC_EXECUTION]: The skill employs subagents to generate HTML-based mockups and wireframes in the .working/ directory. These artifacts are intended for visual review by the user and are opened using standard platform commands (open, xdg-open, start) rather than being executed with elevated privileges or as part of a hidden background process.

bmad-ux