Security Audit
PabloLION/bmad-plugin:plugins/bmad/skills/bmad-cis-agent-brainstorming-coach
github.com/PabloLION/bmad-pluginTrust Assessment
PabloLION/bmad-plugin:plugins/bmad/skills/bmad-cis-agent-brainstorming-coach received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Potential Data Exposure via Broad File Search.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on April 11, 2026 (commit 17efb6ce). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Potential Data Exposure via Broad File Search The skill is instructed to search for and load `**/project-context.md` into the LLM's context. The `**` wildcard indicates a recursive search, which could potentially traverse a wide range of directories. If `project-context.md` files contain sensitive information (e.g., internal project details, API keys, proprietary algorithms, or accidentally committed credentials), loading them into the LLM's context could expose this data to the user or to the LLM provider's logging/training systems. The scope of the search is not explicitly limited, increasing the risk of unintended data exposure. Restrict the file search scope to a specific, known-safe directory (e.g., `./project-context.md` or `docs/project-context.md`). Implement clear guidelines for what kind of information should be stored in `project-context.md` to prevent sensitive data from being included. Consider redacting or filtering content from loaded files before passing it to the LLM, especially if the file's content cannot be fully controlled. | LLM | SKILL.md:40 |
Scan History
Embed Code
[](https://skillshield.io/report/25c93cf266a7e915)
Powered by SkillShield