The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/sprint_plan.py and its test suite use the yaml.load() function to read data from sprint-status.yaml. While using the RoundTrip loader, the lack of an explicit safe loader variant poses a risk when processing files that may have been manually edited or influenced by external sources.
[COMMAND_EXECUTION]: The skill architecture includes hooks for activation_steps_prepend, activation_steps_append, and on_complete within the customize.toml configuration. These hooks provide a mechanism for the agent to execute arbitrary shell commands defined in the project's configuration.
[INDIRECT_PROMPT_INJECTION]: The skill processes various planning artifacts, including epic descriptions and story files, to inform the agent's reasoning. The instructions do not define strict boundary markers or sanitization logic for this external content, creating a vulnerability surface where adversarial instructions embedded in project files could potentially override intended behavior.
[EXTERNAL_DOWNLOADS]: The Python script scripts/sprint_plan.py identifies ruamel.yaml as a required dependency. This package is downloaded from the standard Python package registry when the skill is executed using the uv tool.

bmad-sprint-planning