The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts using the uv tool during its activation sequence. It specifically targets {project-root}/_bmad/scripts/resolve_customization.py and {project-root}/_bmad/scripts/resolve_config.py. If these scripts are modified by a malicious actor within a project, they will be executed when the skill is activated.
[DYNAMIC_EXECUTION]: The skill is configured to execute arbitrary instructions defined in activation_steps_prepend and activation_steps_append. These steps are defined in the customize.toml file and its overrides, allowing the execution of any action the agent is capable of before and after the main greeting.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and merges configuration data from multiple local files, including team and user-specific overrides. This data directly influences the agent's persona, principles, and activation steps, creating an attack surface where malicious local files could control the agent.
Ingestion points: customize.toml, {project-root}/_bmad/custom/bmad-agent-ux-designer.toml, and {project-root}/_bmad/custom/bmad-agent-ux-designer.user.toml.
Boundary markers: None identified for configuration merging or fact loading.
Capability inventory: Subprocess execution via uv run, execution of arbitrary activation steps, and invocation of other skills via the menu system.
Sanitization: No explicit sanitization or validation of the merged configuration content is performed within the skill instructions.
[DATA_EXPOSURE]: The persistent_facts mechanism allows the skill to load the contents of any file or glob pattern (e.g., file:{project-root}/**) into the agent's prompt context. While intended for project knowledge, this could be used to expose sensitive local files if configured to do so in the override files.

bmad-agent-ux-designer