bmad-cis-agent-design-thinking-coach

Pass

Audited by Gen Agent Trust Hub on Aug 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script resolve_customization.py using uv run to process and merge configuration layers (base, team, and user) into the agent's state.
  • [DYNAMIC_EXECUTION]: The skill is instructed to "Execute each entry" in the activation_steps_prepend and activation_steps_append arrays found in the merged configuration. This allows for arbitrary command or script execution defined in the project's environment rather than the skill's own code.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The persistent_facts feature allows the agent to load the contents of local files via file: paths or glob patterns into its foundational context. This creates a risk where sensitive files could be exposed to the LLM if specifically targeted by configuration overrides.
  • [INDIRECT_PROMPT_INJECTION]: The skill lacks sufficient boundary markers and sanitization when processing external data.
  • Ingestion points: Merged TOML configuration files (base, team, user), config.yaml, and local files referenced in persistent_facts (SKILL.md, Step 1, 4, and 5).
  • Boundary markers: None identified; external content is loaded directly as facts or identity parameters.
  • Capability inventory: Shell command execution (activation_steps), local script execution (resolve_customization.py), and file system read access (persistent_facts).
  • Sanitization: No evidence of filtering, escaping, or schema validation for the data ingested from external files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 22, 2026, 02:02 PM
Security Audit — agent-trust-hub — bmad-cis-agent-design-thinking-coach