The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts (resolve_customization.py, resolve_config.py) via uv run to merge configuration files and resolve persona settings at runtime. These scripts are located within the project's internal _bmad/scripts directory.
[INDIRECT_PROMPT_INJECTION]: The skill features a data ingestion surface through the persistent_facts configuration, which can load content from local files (e.g., via file: prefixes). This is used to provide the agent with foundational project context.
[EXTERNAL_DOWNLOADS]: The module-manifest.toml identifies an update source pointing to the vendor's official GitHub repository (bmad-code-org/bmad-skills). This is standard for managing skill updates and does not involve runtime execution of untrusted remote code.

bmad-agent-analyst