gds-ux

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: During its activation phase, the skill directs the agent to execute a local Python script resolve_customization.py using the uv run command. This script is part of the vendor-managed _bmad directory within the project root and is used for configuration resolution.
  • [COMMAND_EXECUTION]: The creative tools and validation synthesis modules utilize platform-specific shell commands, including open (macOS), xdg-open (Linux), and start (Windows). These are used to automatically display generated HTML mockups and reports in the user's default browser.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external planning documents such as Product Requirement Documents (PRDs) and Game Design Documents (GDDs). This represents a standard surface for indirect prompt injection, as malicious instructions embedded within these documents could potentially influence the agent's interpretation of the project goals.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 09:39 PM
Security Audit — agent-trust-hub — gds-ux