bmad-agent-builder

The supplied fragment is an agent bootloader specification, not direct malware. It contains no visible secrets, obfuscated payload, network exfiltration, or destructive operation. However, it establishes a high-impact execution and persistence mechanism: project-controlled scripts and arbitrary activation-step entries are executed, and project files are loaded into agent context. Review the referenced scripts and customization files before use, particularly activation_steps and wake.py. Risk is conditional and cannot be fully assessed from this fragment alone.