bmad-scrum-master

Pass

Audited by Gen Agent Trust Hub on May 5, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes local scripts scripts/generate-story-id.sh, scripts/calculate-velocity.py, and scripts/sprint-burndown.py to automate agile management tasks. These scripts are scoped to project-specific directories and use standard system utilities for processing.
  • [DATA_EXFILTRATION]: No network-related commands (e.g., curl, wget) or external API calls are present in the skill's instructions or scripts. Data operations are restricted to reading from and writing to local project paths such as docs/ and bmad/.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies planning and architecture artifacts as inputs, which represents a potential surface for indirect prompt injection if those files are attacker-controlled. This risk is managed through the skill's narrow operational scope and the use of yaml.safe_load in the provided Python scripts.
  • [SAFE]: No obfuscation, persistence mechanisms, or privilege escalation patterns were detected. All external resource references are internal to the skill package.
Audit Metadata
Risk Level
SAFE
Analyzed
May 5, 2026, 08:06 AM
Security Audit — agent-trust-hub — bmad-scrum-master