bmad-agent-pm

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts (resolve_customization.py and resolve_config.py) using the uv run tool during the activation sequence. These scripts are located within the framework's internal directory (_bmad/scripts/) in the project root.
  • [COMMAND_EXECUTION]: The activation process includes executing sequences of commands or prompts defined in the activation_steps_prepend and activation_steps_append arrays within the customization configuration. This allows for dynamic command execution based on project or user-level overrides.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data that could influence agent behavior.
  • Ingestion points: The agent loads persistent facts from files and glob patterns in the project root (Step 4) and scans additional context using the project_knowledge configuration (Step 5).
  • Boundary markers: There are no specified delimiters or instructions to the agent to treat the loaded file content as data rather than instructions.
  • Capability inventory: The agent has the capability to execute scripts via uv run and perform file system operations as part of its planning workflow.
  • Sanitization: No sanitization or validation logic is applied to the contents of the files loaded into the context.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 10:42 PM
Security Audit — agent-trust-hub — bmad-agent-pm