bmad-gds

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references external resources for installation and documentation, specifically https://github.com/supercent-io/skills-template for the installation template and https://github.com/bmad-code-org/bmad-module-game-dev-studio for upstream documentation and module code. These sources are consistent with the skill's identity and distribution.
  • [COMMAND_EXECUTION]: The skill requests access to the Bash tool to facilitate game development tasks. This includes scaffolding project structures for Unity, Unreal Engine, and Godot, as well as running automated tests and executing development stories.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process external project data, such as existing source code and documentation, while possessing the capability to execute shell commands.
  • Ingestion points: Commands such as bmad-gds-document-project and bmad-gds-dev-story involve reading and analyzing existing project files.
  • Boundary markers: The provided skill files do not define specific delimiters or instructions to ignore embedded prompts in processed data.
  • Capability inventory: The skill utilizes Read, Write, Bash, Grep, and Glob tools across multiple files.
  • Sanitization: No explicit sanitization or validation logic for external project content is described in the skill definition.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 05:04 PM