bmad-brainstorming

SUSPICIOUS: the skill’s stated purpose is benign and mostly aligned with local memlog/config handling, but it executes project-local scripts at activation, creating a trust boundary break with the working tree. No clear credential theft, exfiltration endpoint, or malware behavior is shown, yet the install/execution model is riskier than necessary for a brainstorming coach.