bmad-prd
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various external sources, creating a surface for indirect prompt injection attacks.\n
- Ingestion points: During the 'Discovery' phase in SKILL.md, the agent is instructed to read user-supplied product briefs, research, customer transcripts, and design docs.\n
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when passing extracted content from subagents to the parent agent.\n
- Capability inventory: The agent can execute local Python scripts (uv run), perform web searches via subagents, write to the file system, and execute shell commands to open files in a browser.\n
- Sanitization: There is no evidence of sanitization or filtering of the ingested content before it is processed.\n- [COMMAND_EXECUTION]: The skill performs shell command execution to maintain logs and display reports.\n
- Evidence: Multiple files (SKILL.md, references/headless.md) use uv run to execute internal scripts for logging (memlog.py), configuration (resolve_config.py), and customization (resolve_customization.py).\n
- Evidence: references/validate.md uses platform-specific commands (open, xdg-open, start) to open generated HTML validation reports in the user's browser.\n- [EXTERNAL_DOWNLOADS]: The skill includes functionality to fetch information from the internet to ground product discussions.\n
- Evidence: SKILL.md contains instructions to spawn web-research subagents during the Discovery phase to gather information about the competitive landscape and comparable products.
Audit Metadata