bmad-agent-pm
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
resolve_customization.pyandresolve_config.py) using theuv runtool during the activation sequence. These scripts are located within the framework's internal directory (_bmad/scripts/) in the project root. - [COMMAND_EXECUTION]: The activation process includes executing sequences of commands or prompts defined in the
activation_steps_prependandactivation_steps_appendarrays within the customization configuration. This allows for dynamic command execution based on project or user-level overrides. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data that could influence agent behavior.
- Ingestion points: The agent loads persistent facts from files and glob patterns in the project root (Step 4) and scans additional context using the
project_knowledgeconfiguration (Step 5). - Boundary markers: There are no specified delimiters or instructions to the agent to treat the loaded file content as data rather than instructions.
- Capability inventory: The agent has the capability to execute scripts via
uv runand perform file system operations as part of its planning workflow. - Sanitization: No sanitization or validation logic is applied to the contents of the files loaded into the context.
Audit Metadata