bmad-cis-agent-innovation-strategist
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script
resolve_customization.pylocated within the project's own directory structure ({project-root}/_bmad/scripts/). This is used for merging configuration files (defaults, team overrides, and user overrides) and is a standard architectural pattern for this framework. - [DATA_EXPOSURE]: The skill reads local configuration files (
customize.toml,config.yaml, and user-defined TOML files). This access is scoped to the skill and project directories for the purpose of persona customization and does not involve sensitive system credentials or unauthorized file paths. - [REMOTE_CODE_EXECUTION]: The skill manifest references an update source on GitHub (
github:bmad-code-org/cis-skills/skills). This is a declarative metadata field for the platform's update mechanism and does not trigger immediate or hidden remote code execution during skill operation.
Audit Metadata