bmad-scrum-master
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local scripts
scripts/generate-story-id.sh,scripts/calculate-velocity.py, andscripts/sprint-burndown.pyto automate agile management tasks. These scripts are scoped to project-specific directories and use standard system utilities for processing. - [DATA_EXFILTRATION]: No network-related commands (e.g., curl, wget) or external API calls are present in the skill's instructions or scripts. Data operations are restricted to reading from and writing to local project paths such as
docs/andbmad/. - [INDIRECT_PROMPT_INJECTION]: The skill identifies planning and architecture artifacts as inputs, which represents a potential surface for indirect prompt injection if those files are attacker-controlled. This risk is managed through the skill's narrow operational scope and the use of
yaml.safe_loadin the provided Python scripts. - [SAFE]: No obfuscation, persistence mechanisms, or privilege escalation patterns were detected. All external resource references are internal to the skill package.
Audit Metadata