skf-audit-skill
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The workflow executes numerous local Python scripts using the
uv runcommand. These helpers (e.g.,skf-load-provenance.py,skf-structural-diff.py,skf-extract-public-api.py) are expected to be located in the project's_bmad/skf/shared/scripts/directory and handle the core logic of the audit process. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with untrusted data by auditing external project source code and fetching documentation content from potentially untrusted URLs.
- Ingestion points: The skill reads local project files for structural diffing and external documentation for hash verification.
- Boundary markers: The risk is partially mitigated by using specialized tools for AST parsing and hashing rather than raw text interpretation, though Deep-tier semantic analysis involves agent reasoning over potentially attacker-influenced documentation.
- Capability inventory: The skill has permissions to write analysis reports and JSON data to the
_bmad-outputfolder and execute local scripts viauv. - Sanitization: The use of dedicated parsing and hashing scripts provides a layer of isolation between the untrusted content and the agent's direct reasoning.
- [EXTERNAL_DOWNLOADS]: The skill fetches content from external URLs specified in metadata to verify documentation integrity against recorded hashes. It also queries Git remotes to detect if the upstream source tree has moved beyond the skill's recorded baseline.
Audit Metadata