bmad-sprint-status — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bmad-sprint-status (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Attribution: Sourced from bmad-code-org/BMAD-METHOD by BMAD Code Org.
Goal: Summarize sprint status, surface risks, and recommend the next workflow action.
Your Role: You are a Developer providing clear, actionable sprint visibility. No time estimates — focus on status, risks, and next steps.
checklist.md) resolve from the skill root.{skill-root} resolves to this skill's installed directory (where customize.toml lives).{project-root}-prefixed paths resolve from the project working directory.{skill-name} resolves to the skill directory's basename.Run: python3 {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --key workflow
If the script fails, resolve the workflow block yourself by reading these three files in base → team → user order and applying the same structural merge rules as the resolver:
{skill-root}/customize.toml — defaults{project-root}/_bmad/custom/{skill-name}.toml — team overrides{project-root}/_bmad/custom/{skill-name}.user.toml — personal overridesAny missing file is skipped. Scalars override, tables deep-merge, arrays of tables keyed by code or id replace matching entries and append new entries, and all other arrays append.
Execute each entry in {workflow.activation_steps_prepend} in order before proceeding.
Treat every entry in {workflow.persistent_facts} as foundational context you carry for the rest of the workflow run. Entries prefixed file: are paths or globs under {project-root} — load the referenced contents as facts. All other entries are facts verbatim.
Load config from {project-root}/_bmad/bmm/config.yaml and resolve:
project_name, user_namecommunication_language, document_output_languageimplementation_artifactsdate as system-generated current datetime{communication_language}Greet {user_name}, speaking in {communication_language}.
Execute each entry in {workflow.activation_steps_append} in order.
Activation is complete. Begin the workflow below.
sprint_status_file = {implementation_artifacts}/sprint-status.yaml| Input | Path | Load Strategy |
|---|---|---|
| Sprint status | {sprint_status_file} | FULL_LOAD |
<workflow>
<step n="0" goal="Determine execution mode"> <action>Set mode = {{mode}} if provided by caller; otherwise mode = "interactive"</action>
<check if="mode == data"> <action>Jump to Step 20</action> </check>
<check if="mode == validate"> <action>Jump to Step 30</action> </check>
<check if="mode == interactive"> <action>Continue to Step 1</action> </check> </step>
<step n="1" goal="Locate sprint status file"> <action>Load {project_context} for project-wide patterns and conventions (if exists)</action> <action>Try {sprint_status_file}</action> <check if="file not found"> <output>sprint-status.yaml not found. Run /bmad:bmm:workflows:sprint-planning to generate it, then rerun sprint-status.</output> <action>Exit workflow</action> </check> <action>Continue to Step 2</action> </step>
<step n="2" goal="Read and parse sprint-status.yaml"> <action>Read the FULL file: {sprint_status_file}</action> <action>Parse fields: generated, last_updated, project, project_key, tracking_system, story_location</action> <action>Parse development_status map. Classify keys:</action>
<action>Map legacy story status "drafted" → "ready-for-dev"</action> <action>Count story statuses: backlog, ready-for-dev, in-progress, review, done</action> <action>Map legacy epic status "contexted" → "in-progress"</action> <action>Count epic statuses: backlog, in-progress, done</action> <action>Count retrospective statuses: optional, done</action>
<action>Validate all statuses against known values:</action>
<check if="any status is unrecognized"> <output> Unknown status detected: {{#each invalid_entries}}
{{key}}: "{{status}}" (not recognized){{/each}}
Valid statuses:
</output> <ask>How should these be corrected? {{#each invalid_entries}} {{@index}}. {{key}}: "{{status}}" → [select valid status] {{/each}}
Enter corrections (e.g., "1=in-progress, 2=backlog") or "skip" to continue without fixing:</ask> <check if="user provided corrections"> <action>Update sprint-status.yaml with corrected values</action> <action>Re-parse the file with corrected statuses</action> </check> </check>
<action>Detect risks:</action>
/bmad:bmm:workflows:code-review/bmad:bmm:workflows:create-storylast_updated timestamp is more than 7 days old (or last_updated is missing, fall back to generated): warn "sprint-status.yaml may be stale"</step>
<step n="3" goal="Select next action recommendation"> <action>Pick the next recommended workflow using priority:</action> <note>When selecting "first" story: sort by epic number, then story number (e.g., 1-1 before 1-2 before 2-1)</note>
dev-story for the first in-progress storycode-review for the first review storydev-storycreate-storyretrospective<action>Store selected recommendation as: next_story_id, next_workflow_id, next_agent (DEV)</action> </step>
<step n="4" goal="Display summary"> <output>
Stories: backlog {{count_backlog}}, ready-for-dev {{count_ready}}, in-progress {{count_in_progress}}, review {{count_review}}, done {{count_done}}
Epics: backlog {{epic_backlog}}, in-progress {{epic_in_progress}}, done {{epic_done}}
Next Recommendation: /bmad:bmm:workflows:{{next_workflow_id}} ({{next_story_id}})
{{#if risks}} Risks: {{#each risks}}
{{/each}} {{/if}}
</output> </step>
<step n="5" goal="Offer actions"> <ask>Pick an option: 1) Run recommended workflow now 2) Show all stories grouped by status 3) Show raw sprint-status.yaml 4) Exit Choice:</ask>
<check if="choice == 1"> <output>Run /bmad:bmm:workflows:{{next_workflow_id}}. If the command targets a story, set story_key={{next_story_id}} when prompted.</output> </check>
<check if="choice == 2"> <output>
</output> </check>
<check if="choice == 3"> <action>Display the full contents of {sprint_status_file}</action> </check>
<check if="choice == 4"> <action>Run: python3 {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --key workflow.on_complete — if the resolved value is non-empty, follow it as the final terminal instruction before exiting.</action> <action>Exit workflow</action> </check> </step>
<!-- ========================= --> <!-- Data mode for other flows --> <!-- ========================= -->
<step n="20" goal="Data mode output"> <action>Load and parse {sprint_status_file} same as Step 2</action> <action>Compute recommendation same as Step 3</action> <template-output>next_workflow_id = {{next_workflow_id}}</template-output> <template-output>next_story_id = {{next_story_id}}</template-output> <template-output>count_backlog = {{count_backlog}}</template-output> <template-output>count_ready = {{count_ready}}</template-output> <template-output>count_in_progress = {{count_in_progress}}</template-output> <template-output>count_review = {{count_review}}</template-output> <template-output>count_done = {{count_done}}</template-output> <template-output>epic_backlog = {{epic_backlog}}</template-output> <template-output>epic_in_progress = {{epic_in_progress}}</template-output> <template-output>epic_done = {{epic_done}}</template-output> <template-output>risks = {{risks}}</template-output> <action>Return to caller</action> </step>
<!-- ========================= --> <!-- Validate mode --> <!-- ========================= -->
<step n="30" goal="Validate sprint-status file"> <action>Check that {sprint_status_file} exists</action> <check if="missing"> <template-output>is_valid = false</template-output> <template-output>error = "sprint-status.yaml missing"</template-output> <template-output>suggestion = "Run sprint-planning to create it"</template-output> <action>Return</action> </check>
<action>Read and parse {sprint_status_file}</action>
<action>Validate required metadata fields exist: generated, project, project_key, tracking_system, story_location (last_updated is optional for backward compatibility)</action> <check if="any required field missing"> <template-output>is_valid = false</template-output> <template-output>error = "Missing required field(s): {{missing_fields}}"</template-output> <template-output>suggestion = "Re-run sprint-planning or add missing fields manually"</template-output> <action>Return</action> </check>
<action>Verify development_status section exists with at least one entry</action> <check if="development_status missing or empty"> <template-output>is_valid = false</template-output> <template-output>error = "development_status missing or empty"</template-output> <template-output>suggestion = "Re-run sprint-planning or repair the file manually"</template-output> <action>Return</action> </check>
<action>Validate all status values against known valid statuses:</action>
<check if="any invalid status found"> <template-output>is_valid = false</template-output> <template-output>error = "Invalid status values: {{invalid_entries}}"</template-output> <template-output>suggestion = "Fix invalid statuses in sprint-status.yaml"</template-output> <action>Return</action> </check>
<template-output>is_valid = true</template-output> <template-output>message = "sprint-status.yaml valid: metadata complete, all statuses recognized"</template-output> <action>Run: python3 {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --key workflow.on_complete — if the resolved value is non-empty, follow it as the final terminal instruction before exiting.</action> </step>
</workflow>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.