bmad-build-auto

SUSPICIOUS. The skill is broadly aligned with a local build-automation purpose and shows no direct exfiltration or credential harvesting, but it delegates control to a local script, a generated workflow path, and potentially a sibling skill's setup instructions. That transitive trust and hidden dependency execution make it medium risk rather than benign.