bmad-cis-storytelling

Pass

Audited by Gen Agent Trust Hub on Apr 26, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script (resolve_customization.py) during activation and completion. These calls are used to manage configuration overrides and project-specific customizations, which are standard operational tasks for this framework.
  • [DATA_EXFILTRATION]: No network access or data exfiltration vectors were detected. The skill's operations are confined to reading local project files and writing the final narrative to a local output directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data which could potentially contain malicious instructions.
  • Ingestion points: Reads from {project-root}/_bmad/cis/config.yaml, {project-root}/**/project-context.md, and story-types.csv.
  • Boundary markers: None identified in the prompt instructions.
  • Capability inventory: Executes local Python scripts via python3 and writes files to the local disk.
  • Sanitization: No explicit sanitization or validation of the ingested file content is performed.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 26, 2026, 05:55 AM