bmad-agent-marketing-paid-ads

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to retrieve and process data from external competitor websites and advertising libraries using a browser tool.
  • Ingestion points: references/competitive-research.md uses browser-based commands to extract text from competitor landing pages and ad transparency platforms.
  • Boundary markers: The instructions do not specify the use of delimiters or warnings for the agent when processing this externally-sourced text.
  • Capability inventory: The skill has file-writing capabilities, saving research summaries to project-specific directories (e.g., ./brands/{brand-slug}/channels/paid-ads/content/).
  • Sanitization: No specific filtering or sanitization of the scraped web content is described.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install external tooling from a public repository.
  • Evidence: references/shared-patterns.md suggests using npx skills add to install the agent-browser tool from https://github.com/vercel-labs/agent-browser.
  • Note: The download target is a repository belonging to a well-known technology organization recognized for providing official platform tools.
  • [COMMAND_EXECUTION]: The skill includes shell commands for local environment setup and configuration.
  • Evidence: references/shared-patterns.md contains commands to install Node.js packages and browser dependencies (npm install -g agent-browser && npx playwright install chromium) required for its research functionalities.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 07:17 PM