The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's execution logic is entirely driven by data ingested from external files, specifically references/workflow-steps.md.
Ingestion points: The skill reads workflow definitions (commands and descriptions) from references/workflow-steps.md and story identifiers from sprint-status.yaml.
Boundary markers: No delimiters or sanitization instructions are used when interpolating content from the workflow file into the subagent prompts.
Capability inventory: The skill can execute complex commands via the Task tool (subagent) and has write access to the filesystem to update status files.
Sanitization: There is no validation to ensure the commands retrieved from the workflow file match an expected schema or allow-list.
[COMMAND_EXECUTION]: The skill executes a series of environment-specific slash commands (e.g., /bmad-create-story, /bmad-dev-story, /bmad-code-review) to manage a development lifecycle.
Risk Factor: The skill instructions and the workflow configuration both specify the use of a yolo argument. The skill documentation identifies this as an 'auto-approval' mode, which is intended to bypass manual confirmation prompts for each step in the pipeline.
[DYNAMIC_EXECUTION]: The skill demonstrates dynamic instruction assembly by loading its operational commands at runtime from references/workflow-steps.md.
Instead of having a static set of instructions, the agent functions as an execution engine that translates markdown-based configuration into active tool calls, creating a dependency on the integrity of local project files for its safe operation.

bmad-story-pipeline