bmad-customize
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed as a configuration manager for the BMad framework. Its primary functions involve scanning local directories for metadata, reading configuration schemas, and writing user-defined overrides to a specific project directory (
_bmad/custom/). - [COMMAND_EXECUTION]: The skill executes local helper scripts, such as
list_customizable_skills.py(included in the skill) andresolve_customization.py(expected to be in the project's BMad directory). These executions are used for discovery and verification of the customization state and are within the expected operational scope of the skill. - [DATA_EXPOSURE]: The skill accesses project-specific files like
customize.tomlandSKILL.mdfrom other installed skills. This access is limited to extracting metadata (names, descriptions) and configuration keys required to facilitate the user's customization requests. No sensitive system or user data is accessed. - [DATA_EXFILTRATION]: No network calls, external URLs, or data exfiltration patterns were identified. The skill only performs local file operations and summarizes changes to the user.
Audit Metadata