bmad-dev-auto

SUSPICIOUS: The skill is purpose-aligned and shows no clear malware, exfiltration, or supply-chain abuse, but its unattended design plus execution of mutable local hook/config content creates meaningful operational risk.