bmad-project-context
Fail
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automatically executes Python scripts located in the target project's directory ({project-root}/_bmad/scripts/resolve_customization.py and {project-root}/_bmad/scripts/resolve_config.py) using the uv run command. If an agent is used to analyze an untrusted or malicious repository, that repository can provide its own scripts to execute arbitrary code on the host environment.
- [DYNAMIC_EXECUTION]: During the activation phase, the skill instructs the agent to execute specific steps (activation_steps_prepend and activation_steps_append) defined in the repository's configuration files (_bmad/custom/*.toml). This allows a project to inject executable actions into the agent's workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from multiple project files including AGENTS.md, package.json, and CI configurations to generate repository instructions.
- Ingestion points: Project configuration files (_bmad/custom/*.toml), manifests (package.json, pyproject.toml), and existing instruction files (AGENTS.md).
- Boundary markers: Absent. No protective delimiters or warnings are used when reading data from the repository files.
- Capability inventory: The agent has the ability to execute shell commands via uv run and modify files within the repository.
- Sanitization: Content read from the project is used directly to influence the agent's reasoning and instructions without evidence of filtering or validation.
Recommendations
- AI detected serious security threats
Audit Metadata