bmad-sprint-planning
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv runto executescripts/sprint_plan.pyfor parsing project epics and managing the sprint status file. It also calls local utility scripts for configuration resolution, which is standard for the vendor's toolset. - [DYNAMIC_EXECUTION]: The skill architecture allows for custom workflow steps defined in
customize.toml. These steps are executed by the agent to allow for project-specific automation and extensibility. - [INDIRECT_PROMPT_INJECTION]: The skill ingests planning artifacts from the project directory. While the primary parsing is deterministic, the agent is instructed to manually interpret files if the script fails. Evidence: Ingestion occurs from epics in
{planning_artifacts}; the script ignores code fences but the agent fallback has no specific boundary markers; capabilities include writing to the local file system; the script uses strict regex for data extraction.
Audit Metadata