The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads and installs the bmad-loop package directly from a Git repository (https://github.com/bmad-code-org/bmad-loop.git) using uv tool install. This execution of code from an external, third-party source at runtime is a high-risk pattern.
[EXTERNAL_DOWNLOADS]: Fetches and installs software from a remote Git URL that is not part of a recognized trusted organization.
[DYNAMIC_EXECUTION]: The skill uses uv run to execute a script located at {project-root}/_bmad/scripts/resolve_config.py. Executing scripts from the project's directory poses a risk as the content of the script could be maliciously modified or provided by an untrusted source.
[COMMAND_EXECUTION]: Executes multiple system commands including uv tool install, uv tool upgrade, uv tool list, and bmad-loop subcommands (init, validate, --version) to manage tool lifecycle and project state.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect instructions by ingesting configuration data from ./assets/module.yaml and command-line arguments, and by relaying uncurated output from the bmad-loop init command back to the agent's context.
Ingestion points: Reads metadata from assets/module.yaml and accepts user-provided arguments.
Boundary markers: No explicit delimiters or warnings are used to separate untrusted data from instructions.
Capability inventory: Includes remote package installation, local script execution, and filesystem modifications (mkdir, cp).
Sanitization: There is no evidence of sanitization for the output of commands or values read from configuration files.

bmad-loop-setup