bmad-marketing-growth-module
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The manual installation process instructs the user to clone a repository from a personal GitHub account (
MatthiasMRC/bmad-marketing-growth.git). The quick installation method uses a custom CLI tool (bmad) to fetch module components. - [COMMAND_EXECUTION]: The skill provides integration examples in JavaScript that utilize
child_process.execSyncto run shell commands based on agent workflows. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data for marketing campaigns and content generation, which is then processed through a hierarchical delegation chain. The instructions lack explicit boundary markers or sanitization protocols.
- Ingestion points: User inputs for campaign initialization, content optimization, and social media strategy in
SKILL.md. - Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for processing user content.
- Capability inventory: Execution of shell commands via
bmadandexecSync; read/write access to the local filesystem for agent memory persistence; network operations via Git and external API integrations (SKILL.md). - Sanitization: No sanitization or validation logic is present in the provided instructions or examples.
Audit Metadata