Skills
Navigate
skills/bmad-code-org/bmad-skills/bmad-spec/Gen Agent Trust Hub

bmad-spec

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses uv run to execute local Python scripts (resolve_customization.py, resolve_config.py, and memlog.py) and activation steps defined in configuration files.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content (Slack threads, emails, meeting transcripts) to derive project specs.
  • Ingestion points: Intent input processed in SKILL.md.
  • Boundary markers: None.
  • Capability inventory: File system writes and execution of project-local scripts.
  • Sanitization: None.
  • [EXTERNAL_DOWNLOADS]: The skill manifest references the author's official GitHub repository for updates.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 10:42 PM
Security Audit — agent-trust-hub — bmad-spec