bmad-epic-pipeline-worktree
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and parses
sprint-status.yamlto extract story numbers and names which are then used to drive the execution loop and parameters for another skill (/bmad-story-pipeline-worktree). This creates a vulnerability where malicious content within the repository's status file could attempt to influence the agent's logic. - Ingestion points: The skill reads from
_bmad-output/implementation-artifacts/sprint-status.yamlanddocs/sprint/sprint-status.yaml(found inSKILL.md). - Boundary markers: Absent. The subagent instructions for collecting the story list do not include delimiters or warnings to ignore instructions embedded in the data.
- Capability inventory: The skill has the capability to read local files, execute subagent tasks, and invoke external skills with arguments derived from the parsed data.
- Sanitization: There is no evidence of sanitization, validation, or escaping of the story numbers or names before they are interpolated into the next command execution phase.
- [DYNAMIC_EXECUTION]: The execution logic is partially determined by an external configuration file (
workflow-steps.md) referenced in the documentation. This design allows for runtime modification of the delivery pipeline steps, which is a form of dynamic behavior driven by project-level configuration.
Audit Metadata