bmad-market-research
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a framework-specific Python script
resolve_customization.pylocated in the project's internal_bmad/scripts/directory. This is used to resolve and merge configuration overrides from various customization files. - [PROMPT_INJECTION]: The skill processes untrusted data derived from user inputs and live web search results. Ingestion points: Research topics and goals provided by the user, and search results retrieved during Steps 2 through 6. Boundary markers: The instructions lack explicit delimiters or instructions to ignore embedded commands within the ingested data. Capability inventory: The skill has the ability to write files to the project directory and execute local scripts via Python. Sanitization: The skill applies a slugification process to user-provided topics for safe filename generation, but no specific sanitization is applied to the content of web search results before they are synthesized into the final markdown document. This exposure is typical for research-oriented agents and is mitigated by the structured nature of the workflow steps.
Audit Metadata