bmad-idea

SUSPICIOUS: The skill's stated purpose is benign and mostly aligned with local document-generation workflows, but its installation model is a notable concern. It relies on transitive remote skill installation from a GitHub URL/repo that is not clearly the named skill, which adds medium supply-chain risk despite no direct signs of credential theft or exfiltration.