BMad Method

This skill appears to do what it claims (a local AI-driven development framework), but it requires you to run an external npm installer and its documentation explicitly recommends suppressing permission prompts and automating prompt replies — both risky. Before installing or running the recommended commands: - Inspect the npm package before running npx: check the package repository, package.json, and any install/postinstall scripts for unexpected actions. - Avoid using flags that skip permission checks (for example, --dangerously-skip-permissions or bypassPermissions). Those bypass the runtime's safety mechanisms and make it easier for installer code to execute sensitive actions without explicit consent. - Do the initial install and eval in an isolated environment (throwaway repo, container, or VM) so you can audit created files (_bmad, _bmad-output) before integrating them into real projects. - Monitor any interactive prompts rather than auto-submitting 'yes' blindly. The SKILL.md's examples encourage auto-approval for convenience, but automatic approvals can inadvertently accept harmful operations (e.g., running arbitrary scripts, overwriting files, or pushing code). - Audit generated customization files (.customize.yaml) and any 'critical_actions' before allowing them to run persistently — these can make agents perform actions automatically on startup. - If you don't trust the npm package or the claude binary, do not install. If you need to proceed, ask for the package repository URL or package contents and have someone with npm security experience review install scripts and network behavior first. If you want, I can: (a) list concrete checks to run on the npm package.json and typical install scripts, (b) suggest an isolated container/VM install command template, or (c) scan any provided package.json or postinstall scripts for red flags.