bmad-teach-me-testing

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses uv run to execute local Python scripts (resolve_customization.py, resolve_config.py) located in the project's _bmad/scripts folder for configuration management. It also provides the user with an npx command to install a required sibling skill if it is missing.
  • [DYNAMIC_EXECUTION]: The uv run commands execute scripts at runtime based on the project's root path, which is a standard pattern for BMad skill orchestration.
  • [INDIRECT_PROMPT_INJECTION]: The skill maintains and updates learner progress using local YAML files, creating a potential ingestion surface.
  • Ingestion points: Progress data is read from {test_artifacts}/teaching-progress/{user_name}-tea-progress.yaml during initialization and at the start of each session.
  • Boundary markers: The instructions mandate reading the entire step file, and the step files themselves use standardized headers and goal definitions as logical boundaries.
  • Capability inventory: The skill can execute local scripts, perform file system writes (for progress and notes), and chain to other skills such as bmad-advanced-elicitation and bmad-party-mode.
  • Sanitization: The data is stored in a structured YAML format; the instructions do not specify additional sanitization for inputs interpolated into the progress logs.
  • [EXTERNAL_DOWNLOADS]: The skill links to official documentation and knowledge base fragments hosted on vendor-controlled GitHub Pages and repositories (bmad-code-org.github.io and github.com/bmad-code-org). These are verified resources belonging to the skill author.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 11:15 AM