bmad-os-changelog
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from GitHub Pull Requests.\n
- Ingestion points: The skill uses the
gh pr viewtool to read descriptions and comments from merged PRs as part of its analysis phase inSKILL.md(Step 2).\n - Boundary markers: There are no boundary markers or instructions to treat the ingested PR content as untrusted data, which could lead the agent to follow instructions hidden within PR descriptions.\n
- Capability inventory: The agent has the capability to write output directly to the local
CHANGELOG.mdfile.\n - Sanitization: The included writing quality check in
references/writing-quality.mdis designed for stylistic refinement only and does not perform any security-related sanitization or filtering of the ingested content.\n- [SAFE]: The skill demonstrates safe operational design by explicitly instructing the agent not to execute git commits or trigger GitHub workflows automatically, ensuring that critical repository changes require explicit user action.
Audit Metadata