bmad-cis-agent-design-thinking-coach
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
resolve_customization.pyusinguv runto process and merge configuration layers (base, team, and user) into the agent's state. - [DYNAMIC_EXECUTION]: The skill is instructed to "Execute each entry" in the
activation_steps_prependandactivation_steps_appendarrays found in the merged configuration. This allows for arbitrary command or script execution defined in the project's environment rather than the skill's own code. - [DATA_EXPOSURE_AND_EXFILTRATION]: The
persistent_factsfeature allows the agent to load the contents of local files viafile:paths or glob patterns into its foundational context. This creates a risk where sensitive files could be exposed to the LLM if specifically targeted by configuration overrides. - [INDIRECT_PROMPT_INJECTION]: The skill lacks sufficient boundary markers and sanitization when processing external data.
- Ingestion points: Merged TOML configuration files (base, team, user),
config.yaml, and local files referenced inpersistent_facts(SKILL.md, Step 1, 4, and 5). - Boundary markers: None identified; external content is loaded directly as facts or identity parameters.
- Capability inventory: Shell command execution (
activation_steps), local script execution (resolve_customization.py), and file system read access (persistent_facts). - Sanitization: No evidence of filtering, escaping, or schema validation for the data ingested from external files.
Audit Metadata