The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It is instructed to load project configurations and status from bmad/project.yaml and bmad/workflow-status.yaml. These values, including language settings and workflow names, are used to guide the agent's behavior and the language used in its responses.\n
Ingestion points: bmad/project.yaml and bmad/workflow-status.yaml are read to resolve communication_language and document_output_language.\n
Boundary markers: None identified; the instructions do not define delimiters or ignore markers for content read from these files.\n
Capability inventory: The skill can execute local bash scripts, write files via sed and cp, and transition the agent to different workflow phases.\n
Sanitization: Basic validation of project level (regex ^[0-4]$) and project type (allowed-list) is performed in the init-project.sh script, but other descriptive or configuration fields are not sanitized.\n- [COMMAND_EXECUTION]: The skill executes multiple bash scripts to manage the project lifecycle.\n
scripts/init-project.sh: Creates project directories and uses sed to render project metadata into YAML templates.\n
scripts/show-status.sh: Processes project state using the yq utility and displays completion metrics for different phases.\n
scripts/recommend-next.sh: Executes a logic script (next-workflow.sh) from a shared directory (../bmad-shared/scripts/) located outside the skill's own folder.\n
scripts/validate-config.sh: Uses yq to verify the structure and presence of required fields in the project configuration file.

bmad-orchestrator