gds-create-narrative
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script located at
{project-root}/_bmad/scripts/resolve_customization.pyduring initialization and at the end of the workflow. This script is part of the vendor's internal framework for resolving configuration and completion hooks. - [DATA_EXPOSURE]: The workflow reads from several local project files, including
_bmad/gds/config.yaml,project-context.md, and existing game design documents. This access is limited to the user's project directory and is necessary for providing context-aware narrative assistance. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files which could potentially contain malicious instructions.
- Ingestion points:
{project-root}/_bmad/gds/config.yamland{project-root}/**/project-context.md(viacustomize.toml). - Boundary markers: Content is loaded as foundational facts or used to populate document templates.
- Capability inventory: File system read/write access and local command execution via Python.
- Sanitization: No explicit sanitization or filtering of the ingested project content is mentioned in the instructions.
Audit Metadata