bmad-tea-teach-me-testing

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts such as resolve_customization.py and resolve_config.py using the uv run command. These scripts are located in the {project-root}/_bmad/scripts/ directory and are used to merge configuration files and resolve workflow steps at runtime.
  • [EXTERNAL_DOWNLOADS]: The skill initiates the download and execution of the bmad-method-test-architecture-enterprise package via npx. It also uses npx skills add to fetch and install sibling skills from the vendor's GitHub repository at github.com/bmad-code-org/bmad-method-test-architecture-enterprise.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could potentially contain malicious instructions intended to influence the agent's behavior. It reads user-provided information during the assessment phase and quiz responses during the learning sessions, and it loads documentation fragments from external directories.
  • Ingestion points: User inputs gathered in step-02-assess.md (roles, goals, pain points) and quiz responses in step-04-session-01.md through step-04-session-06.md. It also reads markdown fragments from the {tea-knowledge} directory in step-04-session-07.md.
  • Boundary markers: The skill contains explicit "Mandatory Execution Rules" instructing the agent to act as a facilitator and not to generate unsolicited content without user input.
  • Capability inventory: The agent has the ability to execute shell commands (uv run, npx) and write files to the local file system (e.g., progress YAML files and session notes).
  • Sanitization: The skill performs basic validation of user inputs, such as checking for specific roles or minimum string lengths, but does not implement comprehensive sanitization of external text before it is processed by the agent.
  • [DYNAMIC_EXECUTION]: The workflow architecture includes on_complete hooks and activation step arrays (activation_steps_prepend, activation_steps_append) that execute values resolved from configuration files. This allows the workflow's terminal instructions and activation logic to be modified dynamically based on the contents of customize.toml files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 04:03 PM