bmad-idea
Warn
Audited by Socket on Nov 6, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
The creative-workflow purpose is coherent, but its installation instruction delegates trust to an unverified, unpinned skill source. Treat the transitive installation as a significant supply-chain concern; the provided text alone does not establish malicious intent.
Confidence: 91%Severity: 68%
Audit Metadata