bmad-party-mode
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a project-local Python script (
_bmad/scripts/resolve_config.py) to merge and resolve agent configurations from various local TOML files.- [DATA_EXPOSURE]: The skill accesses local project files, specifically_bmad/core/config.yamlandproject-context.md, to resolve user settings and provide background context for the AI discussion.- [PROMPT_INJECTION]: The skill interpolates untrusted data from the user and project context files into prompts for subagents. While these are organized under clear Markdown headers, there is an absence of explicit boundary markers or instructions to ignore potentially malicious commands embedded in the external data.
Audit Metadata