skills/bmad-code-org/bmad-module-game-dev-studio/gds-check-implementation-readiness/Gen Agent Trust Hub
gds-check-implementation-readiness
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (
resolve_customization.py) during the activation phase and upon completion. This script is located within the{project-root}/_bmad/scripts/directory and is used to merge configuration settings from multiple source files. - [PROMPT_INJECTION]: The skill processes untrusted external data from project-related documents (GDD, Epics, UX, and Architecture files) to create a comprehensive analysis report, which creates a surface for indirect prompt injection.
- Ingestion points: The workflow systematically searches for and reads file contents matching patterns like
{planning_artifacts}/*gdd*.md,{planning_artifacts}/*epic*.md, and{project-root}/**/project-context.md. - Boundary markers: No specific boundary markers or 'ignore embedded instructions' warnings are implemented when interpolating the contents of these documents into the agent's context.
- Capability inventory: The skill possesses the capability to write files (the readiness report) and execute shell commands (via the identified Python scripts).
- Sanitization: The instructions do not specify any validation or sanitization routines for the content extracted from the project documents before it is used to generate the final report.
Audit Metadata