The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a local shell script scripts/validate-brief.sh used for checking the completeness of generated markdown artifacts. The script uses standard utilities (grep, wc) to verify section headers and placeholders. It does not perform any network operations, access sensitive system files, or attempt privilege escalation.
[DATA_EXPOSURE]: The skill is designed to read and write project-specific documentation within the docs/bmad/ directory and bmad/project.yaml. No access to sensitive user configuration files (e.g., .ssh, .aws) or hardcoded credentials was detected.
[PROMPT_INJECTION]: The instructions focus on enforcing business analysis frameworks (5 Whys, JTBD, SMART) and language requirements. There are no attempts to override system prompts, bypass safety filters, or hide malicious instructions.
[EXTERNAL_DOWNLOADS]: The skill does not perform any external network requests or download third-party code. All templates and resources are contained within the skill's own directory structure.

bmad-analyst