bmad-testarch-ci

Pass

Audited by Gen Agent Trust Hub on Apr 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local command execution to resolve workflow configurations and customization overrides (e.g., executing python3 {project-root}/_bmad/scripts/resolve_customization.py). This is a standard extensibility pattern for the BMAD-TEA ecosystem.
  • [COMMAND_EXECUTION]: Support for activation_steps and on_complete hooks allows the execution of arbitrary terminal instructions defined in the project's local customization files. These are documented extension points for post-processing and workflow integration.
  • [EXTERNAL_DOWNLOADS]: The skill generates templates and provides guidance that reference several trusted and well-known services and packages, such as Playwright, Cypress, Pact.js, and LaunchDarkly. It also recommends installing the official @playwright/cli and @smartbear/mcp tools to support AI-driven testing workflows.
  • [SAFE]: The skill incorporates significant security best practices, including a specialized scan in its validation step (steps-v/step-01-validate.md) that flags unsafe interpolation of GitHub context variables (e.g., ${{ github.event.* }}) in generated YAML files to prevent shell command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 26, 2026, 05:56 AM