skills/bmad-code-org/bmad-method/bmad-ticket/Socket

bmad-ticket

Warn

Audited by Socket on Oct 3, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The core ticket-management behavior is coherent, and the cited installer is same-org and documented, but the skill expands trust by instructing a transitive skill install and then executing local BMAD/project scripts. This is a medium supply-chain risk rather than confirmed malicious behavior.

Confidence: 90%Severity: 58%

Audit Metadata

Analyzed At

Oct 3, 2026, 03:15 PM

Package URL

pkg:socket/skills-sh/bmad-code-org%2Fbmad-method%2Fbmad-ticket%2F@a40b3e7c3256613f6fe0084f199e43cb7ae8ee81b21c64f636e958e3736202be