wds-agent-saga-analyst
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script located within the local project directory (
_bmad/scripts/resolve_customization.py) to handle configuration merging. This is a local workflow management task. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from local project files (e.g.,
config.yaml,persistent_facts). This introduces a surface where malformed or adversarial local files could influence the agent's instructions, though the risk is localized to the user's environment. - [DATA_EXPOSURE]: The skill accesses local project configuration and documentation to provide context-aware analysis. No mechanisms were identified for exfiltrating this data to external services.
Audit Metadata