The Agent Skills Directory

[COMMAND_EXECUTION]: The main entry point in SKILL.md instructs the agent to execute a Python script (render_skill.py) located within the project's local _bmad/scripts/ directory using uv run. While this is core to the skill's functionality, it involves executing code from the project directory being analyzed.
[COMMAND_EXECUTION]: The customize.toml file defines an open_spec instruction that dynamically constructs shell commands using project-derived variables {project-root} and {spec_file}. Although the skill includes instructions to double-quote these paths to mitigate injection, the pattern of shell-executing strings built from variable paths remains a minor concern.
[DYNAMIC_EXECUTION]: The workflow involves dynamic assembly and execution of instructions for subagents. step-04-review.md and step-oneshot.md contain logic to substitute placeholders into reviewer prompts and execute customized instructions verbatim, creating a surface for dynamic behavior based on current project state.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including user intent and planning artifacts, creating an indirect prompt injection surface.
Ingestion points: User intent is captured in step-01-clarify-and-route.md, and planning artifacts (PRDs, architecture docs, etc.) are ingested in compile-epic-context.md.
Boundary markers: The spec-template.md uses a <frozen-after-approval> tag to distinguish human-verified intent from agent-generated content, protecting the core specification from unauthorized modifications during automated steps.
Capability inventory: The skill has the capability to write files (step-02-plan.md), execute shell commands (SKILL.md), and spawn subagents (customize.toml, step-04-review.md).
Sanitization: The skill includes explicit instructions in step-01-clarify-and-route.md to ignore directives within the intent that attempt to bypass workflow steps or safety constraints.

bmad-build