bm-md
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to use the
bmmdCLI tool (vianpx -y bmmd) to process Markdown and HTML files. This involves executing shell commands and writing output to files using the--outputflag. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npx -y bmmd, which fetches the package from the npm registry. It also provides functionality to interact withhttps://bm.md/api/markdown/*for remote processing. These resources are vendor-provided and associated with the skill's infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external Markdown and HTML data, which represents a potential attack surface for indirect prompt injection. However, the instructions incorporate safety considerations, such as advising the agent to check facts and the use of the
Pelerenderer, which performs security sanitization on diagrams by blocking external links and image references.
Audit Metadata