registry / bmad-production-grade-dev / 0.1.1

bmad-production-grade-dev@0.1.1

Hardens bmm's story cycle: adversarial multi-reviewer + human-verified customer-experience gate at commit — ship production-grade at AI-native pace.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User explicitly activates the pgd-setup skill and enables hook setup.

Impact

Project configuration, pgd-owned scripts, legacy _bmad directories, and optional Git hooks can be changed.

Mechanism

First-party project setup and developer-workflow automation.

Rationale

This is a benign but powerful explicit setup capability affecting an AI-agent/developer project surface. It warrants a warning under the policy for explicit user-command agent configuration mutation, not a block.

Evidence

package.jsonpgd-setup/SKILL.mdpgd-setup/scripts/cleanup-legacy.pypgd-setup/assets/hooks/pre-commitpgd-setup/assets/hooks/pre-pushpgd-setup/assets/scripts/core/safe-push.mjs_bmad/config.yaml_bmad/config.user.yaml_bmad/module-help.csvscripts/pgd/CLAUDE.pgd.md.husky/pre-commit.husky/pre-push

bmad-production-grade-dev@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code