bmad-gds
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external resources for installation and documentation, specifically
https://github.com/supercent-io/skills-templatefor the installation template andhttps://github.com/bmad-code-org/bmad-module-game-dev-studiofor upstream documentation and module code. These sources are consistent with the skill's identity and distribution. - [COMMAND_EXECUTION]: The skill requests access to the
Bashtool to facilitate game development tasks. This includes scaffolding project structures for Unity, Unreal Engine, and Godot, as well as running automated tests and executing development stories. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process external project data, such as existing source code and documentation, while possessing the capability to execute shell commands.
- Ingestion points: Commands such as
bmad-gds-document-projectandbmad-gds-dev-storyinvolve reading and analyzing existing project files. - Boundary markers: The provided skill files do not define specific delimiters or instructions to ignore embedded prompts in processed data.
- Capability inventory: The skill utilizes
Read,Write,Bash,Grep, andGlobtools across multiple files. - Sanitization: No explicit sanitization or validation logic for external project content is described in the skill definition.
Audit Metadata