bmad-agent-ux-designer

SUSPICIOUS. The core UX-persona behavior is coherent and there is no clear exfiltration, credential harvesting, or malicious payload. Risk comes from transitive trust: the skill can install other skills and execute project-configured activation steps/local scripts, extending trust to unreviewed local or downstream content. Same-org documentation lowers concern, but this still exceeds a purely presentational UX skill's footprint.