bmad-brainstorming

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands (mkdir -p, cp) within step-01-session-setup.md to initialize the brainstorming session environment. These commands are used for legitimate file management within the skill's defined output folder.
  • [PROMPT_INJECTION]: The skill contains internal behavioral instructions in step-03-technique-execution.md, such as simulating a specific 'temperature' for creativity and using 'Anti-Bias' domain pivoting. These are designed to enhance the brainstorming quality and do not attempt to override the underlying AI's safety protocols.
  • [DATA_EXPOSURE]: The skill is designed to read an optional context_file provided by the user to tailor the session. This represents a controlled ingestion point for user-supplied data rather than unauthorized exposure of sensitive system files.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection as it processes external data.
  • Ingestion points: The context_file is loaded in step-01-session-setup.md to inform the session.
  • Boundary markers: None identified in the prompt templates.
  • Capability inventory: The skill can perform file reads (brain-methods.csv, session files), file writes via shell redirection, and directory creation (mkdir).
  • Sanitization: No specific sanitization or escaping of the context file content is performed before it is used to guide the session.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 09:53 AM