bmad-create-epics-and-stories
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local utility scripts using
uv runto manage configuration and customization settings. The scripts executed are_bmad/scripts/resolve_customization.pyand_bmad/scripts/resolve_config.py. These scripts are part of the bmad framework infrastructure and are used for merging settings from TOML files.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external requirement documents, which presents a standard input processing surface. (1) Ingestion points: Reads PRD.md, Architecture.md, and UX design files from the planning_artifacts directory. (2) Boundary markers: The instructions lack explicit boundary markers or instructions to ignore potential commands within the user-provided text. (3) Capability inventory: The skill can execute local scripts viauv runand perform file system writes to epics.md. (4) Sanitization: Content is extracted and mapped directly to markdown templates without intermediate sanitization filters.
Audit Metadata