gds-create-story
Warn
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script located at
{project-root}/_bmad/scripts/resolve_customization.pyusing theuv runcommand during both initialization and finalization phases. - [DYNAMIC_EXECUTION]: The workflow relies on external scripts to resolve configuration and customization logic. Specifically, it resolves the
workflow.on_completekey from local configuration files and follows the resulting output as a terminal instruction, which allows project-level configuration to control agent behavior. - [INDIRECT_PROMPT_INJECTION]: The skill reads multiple external project artifacts and incorporates their content into generated instructions for developer agents. Ingestion points:
sprint-status.yaml,epics.md,gdd.md,architecture.md, andproject-context.md. Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands within these files. Capability inventory: The skill has the ability to execute subprocesses viauv run, perform file system writes, and conduct web research. Sanitization: No sanitization or validation of the ingested artifact content is performed. - [EXTERNAL_DOWNLOADS]: The workflow includes a 'Web research' step to fetch latest technical details from arbitrary external websites.
- [PROMPT_INJECTION]: The
checklist.mdcomponent uses highly directive and adversarial language, such as 'CRITICAL MISSION' and 'DISASTER PREVENTION', to override the agent's default persona with a specialized 'quality validator' persona.
Audit Metadata