bmad-architecture
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
uv runto execute local Python scripts includingmemlog.py,resolve_config.py, andlint_spine.py. These scripts are used for maintaining a 'memlog' (a working memory of decisions) and performing mechanical integrity checks on the generated architecture spine. These operations are scoped to the project and skill directories. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as existing codebases, specifications, and user inputs, to derive architectural patterns. While this provides a potential surface for indirect prompt injection, the skill mitigates this risk through a 'Reviewer Gate' mechanism that uses a mechanical linter (
lint_spine.py) and secondary evaluation lenses to validate the final output. - [DATA_EXPOSURE]: The skill is configured to load persistent facts from
project-context.mdfiles using a recursive glob pattern across the project root. This allows the agent to maintain context of the project's technical stack and conventions, which is a standard feature for architectural analysis in this ecosystem.
Audit Metadata