bmad-tea-nfr

Warn

Audited by Socket on Oct 14, 2026

2 alerts found:

Anomalyx2
AnomalyLOW
steps-v/step-01-validate.md

No explicit malware is evident. The main security concern is the instruction to execute arbitrary non-empty resolver output as a terminal command, which can enable command execution if that output is not trusted and safely constrained. This fragment alone does not establish that the resolver output is malicious.

Confidence: 97%Severity: 55%
AnomalyLOW
steps-e/step-02-apply-edit.md

The fragment contains no direct malware or data-exfiltration behavior. Its main security concern is the delegated execution of an arbitrary non-empty command returned by an external resolver script. This is potentially dangerous if the script or its output can be modified, but malicious intent cannot be established from this fragment alone.

Confidence: 96%Severity: 58%
Audit Metadata
Analyzed At
Oct 14, 2026, 04:01 PM
Package URL
pkg:socket/skills-sh/bmad-code-org%2Fbmad-method-test-architecture-enterprise%2Fbmad-tea-nfr%2F@13f807ddaa9a9ddff79ffdf92e4e293b00d7a34aecd35f688942d64e829afc81