bmad-cis-agent-brainstorming-coach
Warn
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in SKILL.md (Step 2 and Step 7) direct the agent to execute each entry in the activation_steps_prepend and activation_steps_append arrays. Since these arrays are populated from TOML configuration files including user-provided overrides, this creates a mechanism for arbitrary command execution via local configuration.- [COMMAND_EXECUTION]: The activation process in Step 1 executes a specific script located at {project-root}/_bmad/scripts/resolve_customization.py using the uv run command, which constitutes automated command execution when the skill is initialized.- [DATA_EXFILTRATION]: Step 4 of the SKILL.md instructions enables the agent to load arbitrary file contents as foundational context using the file: prefix in the persistent_facts array. This provides a capability to access and ingest sensitive files from the filesystem based on external configuration.- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the lack of boundaries when processing configuration data.
- Ingestion points: The agent loads role, identity, style, and facts from multiple TOML and YAML files in the project directory.
- Boundary markers: No delimiters or safety instructions are used to separate the loaded configuration content from the agent's core instructions.
- Capability inventory: The agent possesses the capability to execute commands and read files, which could be targeted by instructions embedded in the ingested configuration.
- Sanitization: No sanitization or verification of the configuration data is performed before it is adopted into the agent's persona and context.
Audit Metadata