bmad-tea-nfr

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local project scripts (e.g., resolve_customization.py, resolve_config.py) using uv run. It also utilizes npx to run vendor-specific tools for migrations and sibling skill management. These commands are scoped to the project environment and vendor-maintained packages.\n- [INDIRECT_PROMPT_INJECTION]: The workflow ingests external data such as tech-spec.md, PRD.md, story files, and test results. While this provides a surface for indirect prompt injection, the skill employs deterministic assessment rules and structured workers to mitigate the risk of the agent obeying instructions embedded within these files.\n- [DYNAMIC_EXECUTION]: The skill uses on_complete hooks in its validation and report generation steps to trigger local script execution for final processing. This is a standard extension mechanism for the BMad skill ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 04:00 PM