bcms-content
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a Node.js script (
cli/bcms.mjs) that the agent executes to perform content operations such as creating, updating, and deleting entries. - [EXTERNAL_DOWNLOADS]: The skill relies on the
@thebcms/clientpackage, which is the official SDK for the BCMS platform. This is a standard dependency for the skill's functionality. - [DATA_EXFILTRATION]: The skill is designed to read local files and JSON data to upload them to the BCMS platform at
https://app.thebcms.com. This is the core intended purpose of the skill and targets a well-known service domain. - [PROMPT_INJECTION]: The skill retrieves content from the BCMS API and prints it to standard output. There is a surface for indirect prompt injection where an agent might be influenced by malicious instructions stored within the content management system; however, the skill outputs structured JSON and the risk is considered low in the context of a CMS management tool.
Audit Metadata