langchain-bmad
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install external agent skills and software libraries to support the development process.
- It references official LangChain skills from a recognized organization.
- It references complementary skills from the developer's repository (akillness/oh-my-gods).
- [REMOTE_CODE_EXECUTION]: The skill provides commands that download and immediately execute code to install new capabilities.
- It uses npx skills add to fetch and integrate skills from the LangChain organization and the vendor's repository.
- It suggests the installation of development packages via npm and pip.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project information to manage workflow phases, creating a potential surface for instructions embedded in data.
- Ingestion points: The skill logic processes user input and project files such as PRDs or architecture descriptions using the Read tool.
- Boundary markers: There are no specific delimiters or instructions provided to isolate processed data from the agent's control logic.
- Capability inventory: The skill is equipped with powerful tools including Bash, Read, and Write.
- Sanitization: No content filtering or validation is performed on the project artifacts ingested by the skill.
Audit Metadata