bmad-customize

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is designed as a configuration manager for the BMad framework. Its primary functions involve scanning local directories for metadata, reading configuration schemas, and writing user-defined overrides to a specific project directory (_bmad/custom/).
  • [COMMAND_EXECUTION]: The skill executes local helper scripts, such as list_customizable_skills.py (included in the skill) and resolve_customization.py (expected to be in the project's BMad directory). These executions are used for discovery and verification of the customization state and are within the expected operational scope of the skill.
  • [DATA_EXPOSURE]: The skill accesses project-specific files like customize.toml and SKILL.md from other installed skills. This access is limited to extracting metadata (names, descriptions) and configuration keys required to facilitate the user's customization requests. No sensitive system or user data is accessed.
  • [DATA_EXFILTRATION]: No network calls, external URLs, or data exfiltration patterns were identified. The skill only performs local file operations and summarizes changes to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 11:18 AM
Security Audit — agent-trust-hub — bmad-customize