The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several system commands including git, gh (GitHub CLI), npx, and python3 to perform maintenance, fetch updates, and run validation tests.
[EXTERNAL_DOWNLOADS]: The skill uses npx --yes bmad-method@6.12.1-next.0 to download and execute a specific version of the installer tool from the npm registry. This is the primary mechanism for the skill's update functionality.
[INDIRECT_PROMPT_INJECTION]: The skill derives cleanup actions and module removals by reading project-local configuration files such as manifest.yaml and skill-manifest.csv.
Ingestion points: _bmad/_config/manifest.yaml and _bmad/_config/skill-manifest.csv are parsed to identify modules and skill directories (SKILL.md).
Boundary markers: No explicit delimiters are used to wrap the data read from these files.
Capability inventory: The skill performs file system deletions (rm) and package installations (npx) based on the content of these files.
Sanitization: The instructions include manual sanitization logic by requiring "exact name" matching for deletions to prevent accidental removal of supported components.

bmad-update