bmad-orchestrator

The script itself contains no obvious hidden malicious payload, hardcoded credentials, or obfuscation. However it performs risky operations that make a supply-chain compromise easy: it downloads and immediately executes a remote install script (curl | sh) and executes local hook/init scripts without validation. That behavior is a common vector for malicious activity if the remote host or local scripts are compromised. Use caution: review the remote install script and local hook/init scripts before running, or avoid the curl|sh flow. Overall the code is not obviously malicious, but it presents a moderate supply-chain risk due to remote execution and running local unverified scripts.

SUSPICIOUS: the workflow purpose generally matches its document-routing and review-gate behavior, but the install model relies on transitive skill installation from a third-party GitHub repo and references external plannotator/Obsidian flows without clear provenance or endpoint details. Main risk is supply-chain and trust expansion, not confirmed malicious behavior.