bmad-os-changelog-social
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (
git log,git tag) using variables (previous-tag,current-tag) derived from the local repository environment. If a repository contains maliciously named tags (e.g., incorporating shell metacharacters), this could lead to command injection when the agent runs the specified commands.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data fromCHANGELOG.md,.claude-plugin/marketplace.json, and git logs to generate social media content. It lacks boundary markers or sanitization to prevent malicious instructions embedded in these files from influencing the agent's output.\n - Ingestion points:
CHANGELOG.md,.claude-plugin/marketplace.json, and git history metadata.\n - Boundary markers: None present.\n
- Capability inventory: Executes
gitshell commands and writes files to the local filesystem (_bmad-output/social/).\n - Sanitization: No sanitization or validation of input data before interpolation into prompts or shell commands.\n- [PRIVILEGE_ESCALATION]: The skill determines output filenames using metadata (
plugin-name,version) extracted from project files. An attacker could potentially use path traversal sequences (like../) in these fields to trick the agent into writing files to sensitive locations outside the intended output directory.
Audit Metadata