bmad-walkthrough
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local project-specific scripts via
uv run(e.g.,{project-root}/_bmad/scripts/resolve_customization.py) to manage configuration and workflow logic (SKILL.md, steps/step-05-wrapup.md). It also invokes the GitHub CLI (gh) for viewing and approving Pull Requests (steps/step-01-orientation.md, steps/step-05-wrapup.md).\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content that can influence its behavior.\n - Ingestion points: Reads Pull Request descriptions, commit messages, sprint status files, and YAML-based customization files from the project directory (SKILL.md, steps/step-01-orientation.md).\n
- Boundary markers: No explicit delimiters or boundary instructions are used to distinguish untrusted data from the skill's own instructions (SKILL.md).\n
- Capability inventory: Supports shell command execution and arbitrary instruction processing via activation/append steps (SKILL.md, steps/step-05-wrapup.md).\n
- Sanitization: No sanitization or validation is applied to ingested strings or configuration steps before execution (SKILL.md).\n- [PRIVILEGE_ESCALATION]: The skill possesses the capability to perform privileged actions, specifically approving GitHub Pull Requests (
gh pr review --approve). While the skill is designed to prompt the user for confirmation, this capability could be abused if the agent is manipulated by adversarial data (steps/step-05-wrapup.md).
Audit Metadata