bmad-testarch-ci
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local command execution to resolve workflow configurations and customization overrides (e.g., executing
python3 {project-root}/_bmad/scripts/resolve_customization.py). This is a standard extensibility pattern for the BMAD-TEA ecosystem. - [COMMAND_EXECUTION]: Support for
activation_stepsandon_completehooks allows the execution of arbitrary terminal instructions defined in the project's local customization files. These are documented extension points for post-processing and workflow integration. - [EXTERNAL_DOWNLOADS]: The skill generates templates and provides guidance that reference several trusted and well-known services and packages, such as Playwright, Cypress, Pact.js, and LaunchDarkly. It also recommends installing the official
@playwright/cliand@smartbear/mcptools to support AI-driven testing workflows. - [SAFE]: The skill incorporates significant security best practices, including a specialized scan in its validation step (
steps-v/step-01-validate.md) that flags unsafe interpolation of GitHub context variables (e.g.,${{ github.event.* }}) in generated YAML files to prevent shell command injection.
Audit Metadata