gds-create-story

Warn

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script located at {project-root}/_bmad/scripts/resolve_customization.py using the uv run command during both initialization and finalization phases.
  • [DYNAMIC_EXECUTION]: The workflow relies on external scripts to resolve configuration and customization logic. Specifically, it resolves the workflow.on_complete key from local configuration files and follows the resulting output as a terminal instruction, which allows project-level configuration to control agent behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads multiple external project artifacts and incorporates their content into generated instructions for developer agents. Ingestion points: sprint-status.yaml, epics.md, gdd.md, architecture.md, and project-context.md. Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands within these files. Capability inventory: The skill has the ability to execute subprocesses via uv run, perform file system writes, and conduct web research. Sanitization: No sanitization or validation of the ingested artifact content is performed.
  • [EXTERNAL_DOWNLOADS]: The workflow includes a 'Web research' step to fetch latest technical details from arbitrary external websites.
  • [PROMPT_INJECTION]: The checklist.md component uses highly directive and adversarial language, such as 'CRITICAL MISSION' and 'DISASTER PREVENTION', to override the agent's default persona with a specialized 'quality validator' persona.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 5, 2026, 08:01 PM
Security Audit — agent-trust-hub — gds-create-story