skills/bmad-code-org/bmad-module-creative-intelligence-suite/bmad-cis-agent-innovation-strategist/Gen Agent Trust Hub
bmad-cis-agent-innovation-strategist
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script located at {project-root}/_bmad/scripts/resolve_customization.py using the uv run command during the activation phase to resolve its configuration settings.
- [DYNAMIC_EXECUTION]: The skill instructions direct the agent to execute sequences of actions defined in the activation_steps_prepend and activation_steps_append configuration arrays, which represents a dynamic execution vector.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from several external configuration files and persistent facts into the agent's persona and context. 1. Ingestion points: customize.toml, {skill-name}.toml, and files referenced in agent.persistent_facts (SKILL.md). 2. Boundary markers: Absent; external data is merged and interpolated directly into the persona and foundational context. 3. Capability inventory: Execution of shell commands via the resolver script and activation steps (SKILL.md). 4. Sanitization: No evidence of sanitization, escaping, or filtering for the ingested content.
Audit Metadata