gds-document-project
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
resolve_customization.py) located within the project's own directory structure ({project-root}/_bmad/scripts/) to handle configuration and customization logic. This is part of the tool's core functionality for managing user and team overrides. - [EXTERNAL_DOWNLOADS]: The skill references standard project manifests and configuration files (e.g.,
package.json,go.mod,requirements.txt) to identify technologies, but it does not perform arbitrary remote code execution or downloads from untrusted third-party servers. All operations are scoped to the local project root. - [DATA_EXPOSURE]: The workflow involves reading source files to generate documentation. It includes specific guardrails to purge detailed source code from the agent's context after writing summaries to disk, minimizing the risk of large-scale context injection or memory accumulation of sensitive code logic.
- [SAFE]: The skill uses well-defined templates and a CSV-based requirement system (
documentation-requirements.csv) to guide its analysis. The patterns for detection and scan levels (quick, deep, exhaustive) are transparently defined and follow standard development practices for codebase auditing.
Audit Metadata