bmad-story-automator

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repository orchestrator contains deliberate behaviors that will autonomously send local project files and session output to external AI CLIs (claude/codex) — including flags that bypass permission prompts and “YOLO” auto-fix modes — which creates a high risk of unauthorized data exfiltration and undesired autonomous modifications to the repo.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Step 3 execution spawns child sessions whose LLM prompts include the story file body from _bmad-output/implementation-artifacts/{{story_prefix}}-*.md (outsider-authored story text), which is then ingested as free-form prompt content by the agent at runtime.