技能 bmad-orchestrator
📦
bmad-orchestrator
v1.2.0 内容修订 r1 严重 📁 文件系统访问⚙️ 外部命令🌐 网络访问
编排 BMAD 开发工作流
AI 辅助项目经常丢失阶段上下文并跳过评审检查点。此技能会初始化 BMAD 工作流文件、显示当前状态，并引导团队完成基于阶段的规划。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "bmad-orchestrator" from https://skillstore.io/skills/supercent-io-bmad-orchestrator.md and its manifest at https://skillstore.io/api/skills/supercent-io-bmad-orchestrator/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“bmad-orchestrator”。 Check the workflow status for my level 2 project.
预期结果:
该技能会报告项目名称、当前阶段、已完成文档、必需工作，以及推荐的下一个 BMAD 命令。
正在使用“bmad-orchestrator”。 Initialize BMAD for a new web application.
预期结果:
该技能会创建 BMAD 配置、工作流状态跟踪和 stories 文件夹，然后推荐产品简报和 PRD 步骤。
正在使用“bmad-orchestrator”。 Run a gate review for the architecture document.
预期结果:
该技能会准备文档以供 plannotator 评审，在可用时记录批准状态，并说明是需要修订还是继续推进。
安全审计
严重v6 • 2026/7/9 打开版本化报告
Most static findings are Markdown examples, shell helper boilerplate, or benign YAML parsing. Confirmed risks include remote curl-to-shell installation, cross-skill hook execution, unsafe Python fallback argument interpolation, and possible document disclosure through plannotator review.
12
已扫描文件
2,992
分析行数
4
复核项
0
已忽略误报
已确认安全问题 (4)
严重
Pipe to shell pattern
if curl -sSfL https://plannotator.ai/install.sh | sh; then
The script executes curl -sSfL https://plannotator.ai/install.sh | sh. Piping an unauthenticated remote installer directly to a shell is a critical execution risk.
严重
Pipe to shell pattern
curl -sSfL https://plannotator.ai/install.sh | sh
The troubleshooting instructions explicitly use curl -sSfL https://plannotator.ai/install.sh | sh. This is a critical unsafe installation pattern even when presented as documentation.
中
Potential External Document Disclosure
The phase gate script reads a full project document and submits it to plannotator. Sensitive PRDs or architecture notes may leave the repository without a clear consent checkpoint.
The script pipes document content into plannotator submit, and the setup guide describes a browser review workflow. I cannot confirm the service transport details, so severity is medium.
中
Phase Gate Bypass When Review Tool Is Missing
When plannotator is not installed, the review script prints that it is proceeding without review and exits successfully. This weakens the stated strict phase gate rule.
The code exits 0 after announcing review is skipped, while the skill documentation says phase gates should be strict. This is clear business-logic risk rather than a pattern match.
能力复核项 (4)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
严重
Hardcoded URL
if curl -sSfL https://plannotator.ai/install.sh | sh; then
This URL is used in a curl pipeline that downloads and executes a remote installer. That is a real supply-chain risk because network code runs locally without pinning or checksum verification.
严重
Hardcoded URL
curl -sSfL https://plannotator.ai/install.sh | sh
The setup guide tells users to download a remote installer and pipe it to sh. Documentation that directs this execution pattern can lead users to run unverified network code.
高
Path traversal sequence
HOOK_SCRIPT="${SKILL_DIR}/../plannotator/scripts/setup-hook.sh"
The installer resolves a sibling ../plannotator setup-hook.sh and later executes it if present. This crosses the skill boundary and can run adjacent skill code without strong validation.
高
Python subprocess.run
proc = subprocess.run(
The Python fallback is built from shell-interpolated DOC_FILE and TITLE values before running subprocess.run. Crafted arguments can break Python string quoting or alter the call path.
风险因素
📁 文件系统访问 (32)
REFERENCE.md:268 REFERENCE.md:300 REFERENCE.md:318 REFERENCE.md:268 REFERENCE.md:300 REFERENCE.md:318 scripts/check-status.sh:27 scripts/check-status.sh:28 scripts/check-status.sh:47 scripts/check-status.sh:49 scripts/check-status.sh:50 scripts/check-status.sh:51 scripts/check-status.sh:177 scripts/install.sh:103 scripts/install.sh:84 scripts/install.sh:65 scripts/install.sh:66 scripts/phase-gate-review.sh:40 scripts/phase-gate-review.sh:41 scripts/phase-gate-review.sh:43 scripts/phase-gate-review.sh:78 scripts/phase-gate-review.sh:97 scripts/phase-gate-review.sh:108 scripts/phase-gate-review.sh:132 scripts/phase-gate-review.sh:134 scripts/phase-gate-review.sh:142 scripts/phase-gate-review.sh:180 scripts/phase-gate-review.sh:181 scripts/phase-gate-review.sh:183 scripts/phase-gate-review.sh:185 scripts/validate-config.sh:49 scripts/validate-config.sh:61
⚙️ 外部命令 (50)
scripts/check-status.sh:28 scripts/check-status.sh:31 scripts/check-status.sh:49 scripts/check-status.sh:50 scripts/check-status.sh:51 scripts/check-status.sh:55 scripts/check-status.sh:58 scripts/check-status.sh:61 scripts/check-status.sh:1 scripts/init-project.sh:19 scripts/init-project.sh:137 scripts/init-project.sh:1 scripts/install.sh:66 scripts/install.sh:97 scripts/install.sh:192 scripts/install.sh:196 scripts/install.sh:201 scripts/install.sh:1 scripts/phase-gate-review.sh:102 scripts/phase-gate-review.sh:34 scripts/phase-gate-review.sh:41 scripts/phase-gate-review.sh:43 scripts/phase-gate-review.sh:92 scripts/phase-gate-review.sh:124 scripts/phase-gate-review.sh:161 scripts/phase-gate-review.sh:165 scripts/phase-gate-review.sh:170 scripts/phase-gate-review.sh:177 scripts/phase-gate-review.sh:1 scripts/validate-config.sh:94 scripts/validate-config.sh:106 scripts/validate-config.sh:123 scripts/validate-config.sh:145 scripts/validate-config.sh:153 scripts/validate-config.sh:164 scripts/validate-config.sh:1 SKILL.md:27-29 SKILL.md:29-33 SKILL.md:33-34 SKILL.md:34 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42 SKILL.md:58 SKILL.md:59-60 SKILL.md:60 SKILL.md:61 SKILL.md:63-69 SKILL.md:69-72 SKILL.md:72-76
检测到的模式
Pipe to shell pattern×2
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/supercent-io-bmad-orchestrator/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/supercent-io-bmad-orchestrator?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/supercent-io-bmad-orchestrator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supercent-io-bmad-orchestrator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/supercent-io-bmad-orchestrator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
supercent-io. (2026). bmad-orchestrator security audit report (audit version 6) [Author version 1.2.0]. Skillstore. https://skillstore.io/skills/supercent-io-bmad-orchestrator/audits/6BibTeX 引用
@techreport{supercent-io-supercent-io-bmad-orchestrator-2026,
author = {supercent-io},
title = {bmad-orchestrator security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/supercent-io-bmad-orchestrator/audits/6},
note = {Author version 1.2.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "bmad-orchestrator security audit report (audit version 6)"
version: "1.2.0"
type: report
authors:
- name: "supercent-io"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/supercent-io-bmad-orchestrator/audits/6"
identifiers:
- type: other
value: "skillstore:supercent-io-bmad-orchestrator:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 59
架构
100
可维护性
85
内容
69
社区
91
规范符合性
你能构建什么
标准化功能规划
在工程师和 agents 开始实现工作之前，定义共享的 BMAD 阶段路径。
恢复 BMAD 项目
检查工作流状态，并确定下一项必需的规划或实现步骤。
评审阶段交付物
通过结构化评审门发送 PRDs、架构说明或 sprint 计划。
试试这些提示
初始化项目
Initialize BMAD in this repository for a web app named <project>. Ask me for any missing level or output folder choices.
检查当前状态
Check the BMAD workflow status and tell me the next required phase, blocked items, and the command I should run.
评审阶段文档
Review the current PRD with the phase gate process, then summarize required changes before moving to architecture.
规划跨工具编排
Adapt the BMAD phase plan for a level 3 integration project with Codex orchestration, plannotator review, and sprint handoff checkpoints.
最佳实践
- 在运行设置脚本之前，先审查安装程序和网络操作。
- 在生成新的 BMAD 工件之前，先运行工作流状态检查。
- 在阶段门评审之前，将每个阶段文档纳入版本控制。
避免
- 在无人值守环境中运行远程安装程序。
- 因为缺少某个工具而跳过阶段评审。
- 未对齐配置和交付物就手动编辑工作流状态。
常见问题
这个技能有什么用途？
它为 AI 辅助软件项目协调 BMAD 工作流设置、状态检查、阶段路由和评审门。
它能与 Codex 配合使用吗？
可以，但 Codex 的使用被记录为一种编排集成，而不是默认的原生路径。
它会创建项目文档吗？
不能。它会跟踪工作流状态并路由阶段，但 BMAD 文档生成由相关命令或 agents 完成。
为什么使用 plannotator？
plannotator 为 PRDs、架构说明和其他阶段交付物提供可视化评审门。
是否需要 shell 访问权限？
需要。包含的设置、验证、状态和评审辅助工具都是 shell 脚本。
团队在安装前应该审查什么？
团队在运行脚本之前，应审查远程安装命令、plannotator 数据处理方式和 hook 设置。
开发者详情
作者
supercent-io许可证
MIT
作者版本
v1.2.0
Skillstore 修订
r1
引用
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
维护新鲜度
2026/7/18
使用量
9 次下载 · 156 次浏览