skills/magnus919/agent-skills/bmad/Gen Agent Trust Hub

bmad

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and validate user-provided Markdown documents within a repository to define work boundaries.
  • Ingestion points: The scripts/check-spec.py validator reads the content of specification files passed to it as command-line arguments.
  • Boundary markers: The protocol emphasizes clear boundaries using standard Markdown headings and YAML-style frontmatter delimiters.
  • Capability inventory: The validation script is restricted to local file reading and regex-based string parsing using the Python standard library; it does not perform network operations or access sensitive system paths.
  • Sanitization: Content is parsed via regular expressions to extract metadata and headings; there is no dynamic execution of the content found within the documents.
  • [DYNAMIC_EXECUTION]: The test suite includes dynamic module loading for the purpose of validating the core script.
  • Evidence: scripts/test_check_spec.py employs importlib.util to load check-spec.py for automated testing.
  • Context: This activity is confined to local test execution and targets a known, static script file within the same directory, representing standard software testing practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 06:30 AM