bmad
Warn
Audited by Snyk on Apr 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill's installer (scripts/install.sh) runs curl -sSfL https://plannotator.ai/install.sh | sh as part of the default setup, which fetches and executes remote code at runtime to install the plannotator CLI used for phase-gate review.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata