skills/bmad-code-org/bmad-method/bmad-walkthrough/Socket

bmad-walkthrough

Warn

Audited by Socket on Oct 19, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill's main behavior is coherent for BMAD workflow rendering, but it includes transitive installation of another skill through an npm/GitHub chain. No credential harvesting, covert behavior, or off-purpose data exfiltration is evident; the primary concern is trust expansion and execution of project-local workflow content.

Confidence: 88%Severity: 56%

Audit Metadata

Analyzed At

Oct 19, 2026, 12:05 AM

Package URL

pkg:socket/skills-sh/bmad-code-org%2Fbmad-method%2Fbmad-walkthrough%2F@94b68a8570b3cac8200fc5c78fa37fb1580323ee0149abc64c044b358b1d04b6