bmad-create-epics-and-stories
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to processing untrusted external inputs.
- Ingestion points: In
steps/step-01-validate-prerequisites.md, the skill searches for and reads the full contents of user-controlled files includingPRD.md,Architecture.md, and UX contracts (DESIGN.md,EXPERIENCE.md). - Boundary markers: Absent. There are no structural delimiters or specific instruction guardrails telling the model to ignore potential malicious prompts embedded within these documentation files.
- Capability inventory: The skill executes shell commands via
uv runinSKILL.mdandsteps/step-04-final-validation.md, and invokes external agent skills such asbmad-advanced-elicitation,bmad-party-mode, andbmad-help. - Sanitization: Absent. Requirements text is parsed directly from files and interpolated directly into markdown templates without validation.
- [COMMAND_EXECUTION]: The skill routinely executes local shell commands using the
uv runrunner inSKILL.mdandsteps/step-04-final-validation.mdto run workspace-local Python scripts (_bmad/scripts/resolve_customization.pyand_bmad/scripts/resolve_config.py). While these are confined to the project's internal directory structure, they allow dynamic environment interactions.
Audit Metadata