skills/bmad-code-org/bmad-module-creative-intelligence-suite/bmad-cis-storytelling/Gen Agent Trust Hub
bmad-cis-storytelling
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
resolve_customization.py) during activation and completion. These calls are used to manage configuration overrides and project-specific customizations, which are standard operational tasks for this framework. - [DATA_EXFILTRATION]: No network access or data exfiltration vectors were detected. The skill's operations are confined to reading local project files and writing the final narrative to a local output directory.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data which could potentially contain malicious instructions.
- Ingestion points: Reads from
{project-root}/_bmad/cis/config.yaml,{project-root}/**/project-context.md, andstory-types.csv. - Boundary markers: None identified in the prompt instructions.
- Capability inventory: Executes local Python scripts via
python3and writes files to the local disk. - Sanitization: No explicit sanitization or validation of the ingested file content is performed.
Audit Metadata