skills/bmad-code-org/bmad-method-test-architecture-enterprise/bmad-teach-me-testing/Gen Agent Trust Hub
bmad-teach-me-testing
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv runto execute local Python scripts (resolve_customization.py,resolve_config.py) located in the project's_bmad/scriptsfolder for configuration management. It also provides the user with annpxcommand to install a required sibling skill if it is missing. - [DYNAMIC_EXECUTION]: The
uv runcommands execute scripts at runtime based on the project's root path, which is a standard pattern for BMad skill orchestration. - [INDIRECT_PROMPT_INJECTION]: The skill maintains and updates learner progress using local YAML files, creating a potential ingestion surface.
- Ingestion points: Progress data is read from
{test_artifacts}/teaching-progress/{user_name}-tea-progress.yamlduring initialization and at the start of each session. - Boundary markers: The instructions mandate reading the entire step file, and the step files themselves use standardized headers and goal definitions as logical boundaries.
- Capability inventory: The skill can execute local scripts, perform file system writes (for progress and notes), and chain to other skills such as
bmad-advanced-elicitationandbmad-party-mode. - Sanitization: The data is stored in a structured YAML format; the instructions do not specify additional sanitization for inputs interpolated into the progress logs.
- [EXTERNAL_DOWNLOADS]: The skill links to official documentation and knowledge base fragments hosted on vendor-controlled GitHub Pages and repositories (
bmad-code-org.github.ioandgithub.com/bmad-code-org). These are verified resources belonging to the skill author.
Audit Metadata