The Agent Skills Directory

[COMMAND_EXECUTION]: The skill logic requires the agent to execute shell commands and scripts locally.
In SKILL.md, Step 1 runs a Python script {project-root}/_bmad/scripts/resolve_customization.py via uv run to resolve settings.
Steps 2 and 7 iterate through activation_steps_prepend and activation_steps_append arrays, executing each entry as a step.
Step 8 executes prompt strings or invokes skill names defined in the agent.menu array.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its recursive configuration loading.
Ingestion points: Content is ingested from {project-root}/_bmad/cis/config.yaml, customization .toml files, and project files referenced in persistent_facts (Step 4 in SKILL.md).
Boundary markers: The instructions do not define delimiters or "ignore embedded instructions" warnings when interpolating external facts and persona traits into the system prompt.
Capability inventory: The agent has capabilities for shell execution (uv run), file reading, and skill invocation.
Sanitization: No validation or filtering is performed on the content loaded from the project files or customization blocks.
[DATA_EXFILTRATION]: The skill facilitates the ingestion of arbitrary file content into the agent's context through the persistent_facts mechanism.
In SKILL.md, any entry in the persistent_facts array (Step 4) prefixed with file: is treated as a path or glob pattern to be read and loaded as context.
This capability allows the ingestion of sensitive project files into the LLM context, which may then be accessible to the agent or other tools.

bmad-cis-agent-creative-problem-solver