The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions provide a command to download and install the tool from a third-party GitHub repository.
Evidence: npx skills add https://github.com/supercent-io/skills-template --skill bmad-idea in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection where malicious instructions could be embedded in processed data.
Ingestion points: Processes untrusted user input for brainstorming, design thinking, and storytelling workflows (SKILL.md, SKILL.toon).
Boundary markers: Lacks explicit delimiters or markers to differentiate user data from agent instructions.
Capability inventory: The skill is granted Read, Write, Bash, Grep, and Glob tools (SKILL.md).
Sanitization: No evidence of input validation or escaping for external content was found.

bmad-idea