bmad-prfaq

SUSPICIOUS. The core purpose is legitimate, but the skill’s footprint extends beyond coaching into executing unverified local `_bmad` scripts, merged activation steps, and broad file/context loading. `uv` itself appears official and same-org, so this is not malware-level supply-chain behavior, but the local execution and customization hooks make the skill higher risk than a normal documentation/workflow guide.