gds-playtest-plan
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script located at
{project-root}/_bmad/scripts/resolve_customization.pyduring activation and completion to handle configuration merging. This is part of the standard BMad framework workflow. - [DYNAMIC_EXECUTION]: The workflow instructions direct the agent to execute shell commands defined in the
activation_steps_prependandactivation_steps_appendarrays within thecustomize.tomland related override files. This allows for project-specific customization of the activation process. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external game design documents (GDD) and game briefs (
{output_folder}/*gdd*.md,{output_folder}/*brief*.md) to inform the playtest plan, creating an attack surface for embedded instructions. - Ingestion points:
SKILL.md(Workflow Architecture: Input Files). - Boundary markers: None specified for ingested documents.
- Capability inventory: File system write (
playtest-plan.md), subprocess execution (python3script calls). - Sanitization: No explicit sanitization or filtering of ingested document content is described.
Audit Metadata