The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill executes Python scripts located at {project-root}/_bmad/scripts/resolve_customization.py and {project-root}/_bmad/scripts/resolve_config.py using the uv run command. Since {project-root} corresponds to the repository being reviewed, an attacker could submit a Pull Request containing malicious versions of these scripts. When a maintainer initiates the code review workflow, the agent will execute the attacker's code with its current privileges.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data such as code diffs, commit narratives, and specification files to provide context for its review subagents. Maliciously crafted content within these files could influence subagent behavior or lead to instructions being ignored.
Ingestion points: Untrusted data enters the context via git diff output, git log output, the {spec_file}, and files loaded via the persistent_facts glob pattern.
Boundary markers: The skill uses delimiters like CONTENT:, Diff:, and Review content: in its prompts, which help define context but do not fully prevent adversarial injection.
Capability inventory: The skill possesses extensive capabilities including executing shell commands (git, gh, uv), writing files to temporary directories, and launching subagents.
Sanitization: There is no evidence of sanitizing or escaping the ingested content before it is passed to subagents.
[COMMAND_EXECUTION]: The workflow constructs shell commands for git diff and git log using branch names, commit SHAs, or file paths derived from user input or the output of gh pr view. If these inputs contain shell metacharacters and are not rigorously validated, they could be exploited for command injection.
[DATA_EXFILTRATION]: The persistent_facts configuration allows the skill to load file contents into the agent's context using glob patterns. If the resolution of these patterns is not strictly restricted to the project directory, it could lead to the unauthorized exposure of sensitive local files to the LLM context.

bmad-code-review