bmad-agent-marketing-paid-ads
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to retrieve and process data from external competitor websites and advertising libraries using a browser tool.
- Ingestion points:
references/competitive-research.mduses browser-based commands to extract text from competitor landing pages and ad transparency platforms. - Boundary markers: The instructions do not specify the use of delimiters or warnings for the agent when processing this externally-sourced text.
- Capability inventory: The skill has file-writing capabilities, saving research summaries to project-specific directories (e.g.,
./brands/{brand-slug}/channels/paid-ads/content/). - Sanitization: No specific filtering or sanitization of the scraped web content is described.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install external tooling from a public repository.
- Evidence:
references/shared-patterns.mdsuggests usingnpx skills addto install theagent-browsertool fromhttps://github.com/vercel-labs/agent-browser. - Note: The download target is a repository belonging to a well-known technology organization recognized for providing official platform tools.
- [COMMAND_EXECUTION]: The skill includes shell commands for local environment setup and configuration.
- Evidence:
references/shared-patterns.mdcontains commands to install Node.js packages and browser dependencies (npm install -g agent-browser && npx playwright install chromium) required for its research functionalities.
Audit Metadata