bmad-architecture

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes uv run to execute local Python scripts including memlog.py, resolve_config.py, and lint_spine.py. These scripts are used for maintaining a 'memlog' (a working memory of decisions) and performing mechanical integrity checks on the generated architecture spine. These operations are scoped to the project and skill directories.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as existing codebases, specifications, and user inputs, to derive architectural patterns. While this provides a potential surface for indirect prompt injection, the skill mitigates this risk through a 'Reviewer Gate' mechanism that uses a mechanical linter (lint_spine.py) and secondary evaluation lenses to validate the final output.
  • [DATA_EXPOSURE]: The skill is configured to load persistent facts from project-context.md files using a recursive glob pattern across the project root. This allows the agent to maintain context of the project's technical stack and conventions, which is a standard feature for architectural analysis in this ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 08:21 AM
Security Audit — agent-trust-hub — bmad-architecture