gds-create-game-brief
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
resolve_customization.py) located in the project's_bmad/scriptsdirectory during the activation phase to resolve workflow settings. - [EXTERNAL_DOWNLOADS]: The skill employs subagents to perform web research during the 'Discovery' phase, fetching data related to market trends, comparable titles, and genre landscapes.
- [DATA_EXFILTRATION]: The skill supports 'external handoffs' at the finalization stage, which are designed to transmit artifacts to external platforms such as Confluence, Notion, or Slack using MCP tools.
- [PROMPT_INJECTION]: The skill processes untrusted data originating from user-supplied source materials and web research digests.
- Ingestion points: User-provided pitch decks, design notes, prototypes, and web research results (referenced in
SKILL.md). - Boundary markers: The skill implements an 'Extract, don't ingest' policy where subagents filter and summarize external data before it enters the parent context.
- Capability inventory: Writing to the local file system (briefs and decision logs), executing local framework scripts, and performing network handoffs via MCP tools.
- Sanitization: The skill relies on relevance-filtered extraction by subagents rather than explicit prompt sanitization or character escaping.
Audit Metadata