bmad-agent-po

Savant verdict: Review advised

Security analysis or source-hub review identified patterns requiring attention.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Security assessment

10 patterns found

• Prompt Injection: <!-- At create a container gets all but Requirements and Constraints, which SPEC writes from an input. An epic written at slicing gets Description, Outcome, Boundaries, Done when as far as known, andhigh · assets/ticket-template.md:19 · Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
• MCP Least Privilege: Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, shell.medium · SKILL.md:1 · Without declared permissions the skill's intent is opaque and cannot be validated.
• Dangerous Code Execution: subprocess.run( [sys.executable, str(SCRIPT), "--starters-dir", str(self.starters), *args], encoding="utf-8", capture_output=True, check=False,medium · scripts/tests/test_read_store.py:65 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• Dangerous Code Execution: subprocess.run( [sys.executable, str(SCRIPT), "--starters"], encoding="utf-8", capture_output=True, check=False )medium · scripts/tests/test_read_store.py:142 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• Dangerous Code Execution: subprocess.run( [sys.executable, str(SCRIPT), *args], encoding="utf-8", capture_output=True, check=False, cwd=cwd, input=stdin )medium · scripts/tests/test_tickets.py:77 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• Dangerous Code Execution: subprocess.run([sys.executable, str(SCRIPT), "next", str(self.epic)], capture_output=True, check=False)medium · scripts/tests/test_tickets.py:275 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• Dangerous Code Execution: subprocess.run([sys.executable, str(SCRIPT), "pull", str(self.epic), "1"], capture_output=True, check=False)medium · scripts/tests/test_tickets.py:279 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• Dangerous Code Execution: re = path.read_bytes() r = subprocess.run( [sys.executable, str(SCRIPT), "mark", str(self.epic), "1", "blocked", "--blocked", b"\xff"], capture_output=True,medium · scripts/tests/test_tickets.py:1324 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• Dangerous Code Execution: il.copy(SCRIPT, installed) r = subprocess.run( [sys.executable, str(installed / "tickets.py"), "next"], text=True, capture_output=True, check=Famedium · scripts/tests/test_tickets.py:1986 · subprocess module calls execute external commands. Without careful input validation, this enables command injection.
• MCP Rug Pull: npx skillsmedium · workflow.md:41 · npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Structure

• Ships 4 executable scriptsscripts/read_store.py, scripts/tests/test_read_store.py, scripts/tests/test_tickets.py, scripts/tickets.py. Review what they do before enabling the skill for agents with tool access.
• No license declaredConfirm you may reuse this skill before importing it into your repository.
• The source hub's security checks flagged this skillSnyk: warn (Risk: MEDIUM · 1 issue)

SKILL.md

---
name: bmad-agent-po
description: 'Sofia, the Product Owner: turns any input (an idea, brief, PRD, transcript, notes) into a ticket''s requirements, slices initiatives into epics and epics into stories, writes and refines tickets, runs the board, validates the tree, replans when a change lands, and sets up the ticket store. Use when the user asks for Sofia or the product owner, or says ''create a spec'', ''distill this PRD'', ''write the initiative from'', ''slice this'', ''split this epic'', ''break this into stories'', ''make a ticket'', ''refine this ticket'', ''what''s ready'', ''status of'', ''publish'', ''validate these tickets'', ''this changed, what now'', ''set up the ticket store''.'
---

Run the following command exactly once without changing the current working directory.

Replace `{project-root}` with the nearest folder containing `_bmad/`, from the working directory upward.
Replace `{skill-root}` with the absolute path to this skill's directory.

```bash
uv run --no-cache "{project-root}/_bmad/scripts/render_skill.py" --project-root "{project-root}" --skill "{skill-root}"
```

- The command prints the skill's workflow: follow it. `HALT: <reason>`: report the reason and stop.
- If the script does not exist, BMad is not set up in this project yet. Offer to set it up using `bmad` skill, then run the command again. If you do not have the `bmad` skill, offer to install it first.
- On any other output or failure, including `uv` being unavailable, report the command output and stop. Do not run any workflow source directly.