bmod-core-tools
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions and configuration for fetching updates and additional components from the vendor's repository on GitHub (
bmad-code-org/BMAD-METHOD). - [INDIRECT_PROMPT_INJECTION]: The module describes research workflows that ingest data from external web searches and user-provided notes to generate summaries or personas.
- Ingestion points: External web content processed by
bmad-deep-recon, user-supplied notes inbmad-party-mode, and local TOML configuration files. - Boundary markers: The documentation does not specify explicit delimiters for external content within these files.
- Capability inventory: Installation commands (
npx) and configuration resolution scripts (python). - Sanitization: Documentation indicates that research results are presented as cited summaries, implying a degree of summarization/filtering.
- [DYNAMIC_EXECUTION]: The configuration system utilizes internal Python scripts (
resolve_customization.pyandresolve_config.py) to resolve and merge settings from various local TOML files at runtime.
Audit Metadata