bmad-builder
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local bash scripts for its primary operations, specifically
scripts/scaffold-skill.shandscripts/validate-skill.sh. These scripts perform standard filesystem tasks such as directory creation (mkdir) and file generation (cat). - [COMMAND_EXECUTION]: Input validation is implemented in
scripts/scaffold-skill.sh, which uses a regular expression (^[a-z][a-z0-9-]*$) to ensure that skill names follow a safe, lowercase kebab-case format before being used in directory creation. - [SAFE]: The skill does not perform any network operations, access sensitive system files (e.g., SSH keys or environment secrets), or download external code. All templates and resources are provided locally within the skill package.
- [SAFE]: No obfuscation, persistence mechanisms, or privilege escalation attempts were identified during the analysis. The logic is transparent and aligned with the stated purpose of project scaffolding.
Audit Metadata