bmad-agent-ux-designer

SUSPICIOUS: the stated purpose is a UX-designer persona, but activation includes arbitrary config-driven command execution and broad local file loading. The external tool (`uv`) appears legitimate, and there is no explicit credential theft or exfiltration endpoint in the skill text, so this is not confirmed malware; however, the execution and context-loading scope is broader than strictly necessary for a UX skill and depends heavily on unreviewed local `_bmad` content.