skf-setup

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs shell command execution to manage the project environment, including directory management commands like mkdir, mktemp, rm, and rmdir, and interaction with external CLI tools qmd and ccc.\n- [DYNAMIC_EXECUTION]: The skill allows for the execution of arbitrary shell commands through user-configurable hooks such as on_complete, activation_steps_prepend, and activation_steps_append defined in customize.toml files.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files and external tool outputs, creating a surface for indirect instructions.\n
  • Ingestion points: Configuration data is read from {project-root}/_bmad/skf/config.yaml, preferences.yaml, and customize.toml. Tool output is parsed from qmd and ccc CLI calls.\n
  • Boundary markers: Data is staged using a JSON-formatted heredoc in references/report.md to maintain structure, though variables are interpolated directly into the template.\n
  • Capability inventory: The skill possesses the ability to write to the file system, execute arbitrary shell commands via configuration hooks, and run local Python scripts using uv run.\n
  • Sanitization: A Halt contract provides basic character escaping for error messages, replacing single quotes with backticks and normalizing slashes.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 02:49 PM