The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted "content" (such as code diffs, branches, and documents) through various LLM-based "lenses". This creates a surface where malicious instructions embedded in the reviewed artifacts could attempt to influence the agent's behavior.
Ingestion points: The skill reads content (diffs/files) in SKILL.md and a claims narrative file in references/lens-edge-case-hunter.md.
Boundary markers: The skill includes mitigation instructions for subagents, telling them to "Return ONLY your findings" and "Do not invoke any skill".
Capability inventory: The skill possesses the ability to execute shell commands via uv run, write to the system temporary directory, and spawn subagents.
Sanitization: No explicit sanitization or filtering of the ingested content is performed before it is analyzed by the reviewer subagents.
[COMMAND_EXECUTION]: The skill relies on executing Python scripts within the local environment to manage customization and metrics.
Evidence: SKILL.md executes a script located at {project-root}/_bmad/scripts/resolve_customization.py to resolve user overrides.
Evidence: references/editorial-common.md executes {skill-root}/scripts/word_metrics.py to generate document statistics.
Evidence: SKILL.md invokes repository version-control tooling to generate diffs and write them to temporary files.
[PROMPT_INJECTION]: The instructions for the adversarial lens employ specific patterns to override the model's standard evaluation logic.
Evidence: references/lens-adversarial.md contains directives such as "Find at least ten issues to fix or improve" and "If you have zero findings, re-check and keep thinking; do not stop with an empty list", which forces the agent to bypass its own determination if no issues are initially found.

bmad-review