skills/miantiao-me/bm.md/bm-md/Gen Agent Trust Hub

bm-md

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to use the bmmd CLI tool (via npx -y bmmd) to process Markdown and HTML files. This involves executing shell commands and writing output to files using the --output flag.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx -y bmmd, which fetches the package from the npm registry. It also provides functionality to interact with https://bm.md/api/markdown/* for remote processing. These resources are vendor-provided and associated with the skill's infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external Markdown and HTML data, which represents a potential attack surface for indirect prompt injection. However, the instructions incorporate safety considerations, such as advising the agent to check facts and the use of the Pele renderer, which performs security sanitization on diagrams by blocking external links and image references.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 04:30 AM