bmad-auto-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The setup explicitly installs the orchestrator from Git at runtime using commands like uv tool install "bmad-auto[tui] @ git+https://github.com/bmad-code-org/bmad-auto.git", which fetches and installs remote code that is then executed (bmad-auto init / bmad-auto validate) and is required for the skill to function.