gds-playtest-plan
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a Python script (
resolve_customization.py) located in the project's_bmad/scriptsdirectory. This script is used to merge configuration settings from various local TOML files during activation and completion. - [DYNAMIC_EXECUTION]: The workflow allows for executing arbitrary steps defined in the
activation_steps_prepend,activation_steps_append, andon_completeconfiguration variables. These steps are sourced from local configuration files (customize.tomland project-specific overrides), providing a mechanism for project-specific automation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project files to inform the playtest plan, creating a surface for indirect prompt injection.
- Ingestion points: Game design documents (
*gdd*.md), game briefs (*brief*.md), and project context files (project-context.md) located in the project root. - Boundary markers: The instructions do not define explicit delimiters or instructions for the agent to ignore commands that might be embedded in these source files.
- Capability inventory: The agent has the capability to execute local scripts and write files to the project directory.
- Sanitization: No specific filtering or sanitization of the ingested text is performed before it is processed by the agent.
Audit Metadata