bmad-story-pipeline-worktree
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the {STORY_ID} variable, which is sourced from untrusted user input or external files. This creates a command injection vulnerability where an attacker could execute arbitrary code by including shell metacharacters in the story ID. Evidence: 'git worktree add -b feature/story-${STORY_ID}' in SKILL.md.
- [INDIRECT_PROMPT_INJECTION]: The skill reads data from local files and uses it to drive the logic of shell commands and subagent prompts. 1. Ingestion points: '_bmad-output/implementation-artifacts/sprint-status.yaml' and 'docs/sprint/sprint-status.yaml'. 2. Boundary markers: None. 3. Capability inventory: Shell execution (git, cd), directory traversal (../), and subagent calls (Task). 4. Sanitization: None identified; the story ID is used directly.
- [DYNAMIC_EXECUTION]: The skill dynamically reads command definitions from 'references/workflow-steps.md' and executes them via a subagent. This allows the behavior of the skill to be altered by modifying the configuration file.
- [COMMAND_EXECUTION]: The skill uses a 'yolo' flag in its commands, specifically intended to auto-approve actions and bypass user confirmation, which increases the impact of other vulnerabilities. Evidence: Commands in 'references/workflow-steps.md' include the 'yolo' argument.
Recommendations
- AI detected serious security threats
Audit Metadata