Skills
skills/akillness/skills-template/bmad-orchestrator/Gen Agent Trust Hub

bmad-orchestrator

Fail

Audited by Gen Agent Trust Hub on Mar 15, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The scripts/install.sh script utilizes a high-risk execution pattern where it downloads a script from https://plannotator.ai/install.sh and pipes it directly into the shell (curl -sSfL ... | sh). This method provides no opportunity for code verification or integrity checking before execution.- [EXTERNAL_DOWNLOADS]: The skill depends on external assets and installation scripts hosted at plannotator.ai. As this domain is not included in the trusted vendors or well-known services list, the downloads are considered untrusted.- [COMMAND_EXECUTION]: The skill relies on various shell scripts and Python-based subprocess calls to manage its workflow. For example, scripts/phase-gate-review.sh invokes the plannotator CLI, and scripts/check-status.sh uses Python to parse YAML data, representing a broad surface of local command execution.
Recommendations
  • HIGH: Downloads and executes remote code from: https://plannotator.ai/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Mar 15, 2026, 07:13 PM