The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes bash scripts that utilize the "yq" utility for YAML processing. These scripts primarily use environment variable expansion within "yq" filters ("strenv"), which is a secure practice to prevent query injection.\n- [DATA_EXFILTRATION]: No network-enabled commands (such as "curl" or "wget") are present. Data operations are limited to reading and writing local project files ("bmad/project.yaml", "bmad/workflow-status.yaml") and a specific application config file ("~/.config/bmad/global-config.yaml").\n- [PROMPT_INJECTION]: While the skill ingests project-specific YAML data to compute workflow transitions, the logic is restricted to pre-defined intent strings and uses structured parsing, which is the intended primary purpose of the skill.\n- [SAFE]: No obfuscation, persistence mechanisms, or credential harvesting patterns were identified.

bmad-shared