bmod-bmad-loop
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configuration in
bmod.tomldefines update sources and required dependencies located in the vendor's GitHub repositories. These references are used for standard module management and skill updates within the author's ecosystem. - [INDIRECT_PROMPT_INJECTION]: The orchestration system described in the documentation is designed to ingest untrusted data from external sources to drive automation.
- Ingestion points: Ticket trees and sprint status files (e.g.,
sprint-status.yaml) processed by the orchestrator. - Boundary markers: Not explicitly defined in the provided metadata and help files.
- Capability inventory: The system spawns coding-agent sessions, executes project-level build checks, and performs git commits based on ticket content.
- Sanitization: Input sanitization for ticket data is not detailed in the provided documentation.
Audit Metadata