bmad-orchestrate
Fail
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of CLI tools including git, tmux, and claude to manage worktrees and execute parallel workflows.
- [PRIVILEGE_ESCALATION]: The Workflows/Execute.md file explicitly instructs the agent to use the --dangerously-skip-permissions flag when running commands via the claude CLI. This flag bypasses built-in safety mechanisms and user confirmation prompts for potentially dangerous operations.
- [INDIRECT_PROMPT_INJECTION]: The Analyze workflow identifies an attack surface where instructions from untrusted external sources could influence agent behavior.
- Ingestion points: Reads sprint-status.yaml and epics.md from the project root.
- Boundary markers: None; the skill does not use delimiters to wrap the ingested content or instruct the agent to ignore embedded commands.
- Capability inventory: The skill can execute shell commands, manage background processes (tmux), and spawn subagents.
- Sanitization: None; data from these files is directly used to calculate dependencies and generate the execution phase plan.
- [DYNAMIC_EXECUTION]: The skill dynamically generates shell commands using variables derived from project files and executes them in background panes using tmux send-keys.
Recommendations
- AI detected serious security threats
Audit Metadata