bmad-testarch-evaluate

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands using uv run and npm exec to perform operational tasks like loading configurations and running the evaluation engine components. This behavior is consistent with the skill's role as a developer-facing testing tool.
  • [DYNAMIC_EXECUTION]: The skill uses internal Node.js scripts to automate the processing of test results and the verification of the evaluation environment. These scripts execute shell commands and utilize Node.js APIs to interact with the file system and external testing frameworks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes output from external agents and test probes. It addresses potential security risks associated with untrusted data by implementing sanitization rules for assertions (blocking code and template execution) and by executing test targets within isolated, confined environments using system tools like Bubblewrap and Seatbelt.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 10:42 AM