registry / bmad-module-skill-forge / 2.0.1

bmad-module-skill-forge@2.0.1

BMAD module — Turn code and docs into instructions AI agents can actually follow. Progressive capability tiers (Quick/Forge/Forge+/Deep).

AI Security Review

scanned 14h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `bmad-module-skill-forge install` or `update` in a project.

Impact

Installed skills can influence AI-agent behavior in that project; no unconsented lifecycle mutation or exfiltration was confirmed.

Mechanism

Copies first-party skill files into selected IDE skill directories and records an uninstall manifest.

Rationale

This is an explicit-user-command, first-party AI-agent configuration capability. Under the stated policy it warrants a warning, not a block, because the mutation is interactive and project-local with no confirmed malicious chain.

Evidence

package.jsontools/skf-npx-wrapper.jstools/cli/skf-cli.jstools/cli/commands/install.jstools/cli/commands/update.jstools/cli/lib/installer.jstools/cli/lib/ide-skills.jstools/cli/lib/version-check.jstools/cli/lib/platform-codes.yaml_bmad/skf_bmad/_memory/forger-sidecar_bmad/_config/skf-manifest.yaml.agents/skills.claude/skills.cursor/skills

bmad-module-skill-forge@2.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code