bmad-ux
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv runto execute local Python scripts for project management (resolve_customization.py,memlog.py). These scripts are located within the{project-root}/_bmad/scripts/directory, which is part of the vendor's own file structure. - [EXTERNAL_DOWNLOADS]: The skill references the Google Labs DESIGN.md specification hosted on GitHub (
github.com/google-labs-code/design.md) and recommends the Google Stitch web tool. These are well-known, trusted resources used for documentation and design purposes. - [COMMAND_EXECUTION]: The skill uses platform-specific commands (
open,xdg-open,start) to open generated HTML and Excalidraw files in the user's browser or desktop environment for review. This is standard behavior for design-oriented tools.
Audit Metadata