bmad-os-findings-triage

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). High risk — the orchestration explicitly trusts agent-sent "DECISION" messages as if they were human authorization and automates applying edits, committing, pushing, posting PR comments, and deleting the team, which could be abused by a compromised or malicious agent to inject backdoors or unauthorized code changes and then hide traces (no explicit external exfiltration endpoints shown, but local config/file reads and GitHub API calls provide avenues for abuse).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches GitHub pull request review threads using gh api graphql in Phase 3 when a PR URL is provided, and those user-generated review comments are read and used to match findings and drive follow-up actions (posting replies, resolving threads), so untrusted third-party content can materially influence the agent's actions.