技能 bmad-orchestrator
📦
bmad-orchestrator
v1.2.0 內容修訂 r1 嚴重 📁 檔案系統存取⚙️ 外部命令🌐 網路存取
協調 BMAD 開發工作流程
AI 輔助專案經常遺失階段脈絡並跳過審查檢查點。此技能會初始化 BMAD 工作流程檔案、顯示目前狀態，並引導團隊進行以階段為基礎的規劃。
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "bmad-orchestrator" from https://skillstore.io/skills/supercent-io-bmad-orchestrator.md and its manifest at https://skillstore.io/api/skills/supercent-io-bmad-orchestrator/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「bmad-orchestrator」。 Check the workflow status for my level 2 project.
預期結果:
此技能會回報專案名稱、目前階段、已完成文件、必要工作，以及建議的下一個 BMAD command。
正在使用「bmad-orchestrator」。 Initialize BMAD for a new web application.
預期結果:
此技能會建立 BMAD config、workflow status tracking 與 stories folder，然後建議 product brief 與 PRD 步驟。
正在使用「bmad-orchestrator」。 Run a gate review for the architecture document.
預期結果:
此技能會準備文件以供 plannotator review，在可取得時記錄核准狀態，並說明應修訂或繼續。
安全審計
嚴重v6 • 2026/7/9 開啟版本化報告
Most static findings are Markdown examples, shell helper boilerplate, or benign YAML parsing. Confirmed risks include remote curl-to-shell installation, cross-skill hook execution, unsafe Python fallback argument interpolation, and possible document disclosure through plannotator review.
12
已掃描檔案
2,992
分析行數
4
複核項目
0
已忽略的誤報
已確認的安全問題 (4)
嚴重
Pipe to shell pattern
if curl -sSfL https://plannotator.ai/install.sh | sh; then
The script executes curl -sSfL https://plannotator.ai/install.sh | sh. Piping an unauthenticated remote installer directly to a shell is a critical execution risk.
嚴重
Pipe to shell pattern
curl -sSfL https://plannotator.ai/install.sh | sh
The troubleshooting instructions explicitly use curl -sSfL https://plannotator.ai/install.sh | sh. This is a critical unsafe installation pattern even when presented as documentation.
中
Potential External Document Disclosure
The phase gate script reads a full project document and submits it to plannotator. Sensitive PRDs or architecture notes may leave the repository without a clear consent checkpoint.
The script pipes document content into plannotator submit, and the setup guide describes a browser review workflow. I cannot confirm the service transport details, so severity is medium.
中
Phase Gate Bypass When Review Tool Is Missing
When plannotator is not installed, the review script prints that it is proceeding without review and exits successfully. This weakens the stated strict phase gate rule.
The code exits 0 after announcing review is skipped, while the skill documentation says phase gates should be strict. This is clear business-logic risk rather than a pattern match.
能力複核項目 (4)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
嚴重
Hardcoded URL
if curl -sSfL https://plannotator.ai/install.sh | sh; then
This URL is used in a curl pipeline that downloads and executes a remote installer. That is a real supply-chain risk because network code runs locally without pinning or checksum verification.
嚴重
Hardcoded URL
curl -sSfL https://plannotator.ai/install.sh | sh
The setup guide tells users to download a remote installer and pipe it to sh. Documentation that directs this execution pattern can lead users to run unverified network code.
高
Path traversal sequence
HOOK_SCRIPT="${SKILL_DIR}/../plannotator/scripts/setup-hook.sh"
The installer resolves a sibling ../plannotator setup-hook.sh and later executes it if present. This crosses the skill boundary and can run adjacent skill code without strong validation.
高
Python subprocess.run
proc = subprocess.run(
The Python fallback is built from shell-interpolated DOC_FILE and TITLE values before running subprocess.run. Crafted arguments can break Python string quoting or alter the call path.
風險因素
📁 檔案系統存取 (32)
REFERENCE.md:268 REFERENCE.md:300 REFERENCE.md:318 REFERENCE.md:268 REFERENCE.md:300 REFERENCE.md:318 scripts/check-status.sh:27 scripts/check-status.sh:28 scripts/check-status.sh:47 scripts/check-status.sh:49 scripts/check-status.sh:50 scripts/check-status.sh:51 scripts/check-status.sh:177 scripts/install.sh:103 scripts/install.sh:84 scripts/install.sh:65 scripts/install.sh:66 scripts/phase-gate-review.sh:40 scripts/phase-gate-review.sh:41 scripts/phase-gate-review.sh:43 scripts/phase-gate-review.sh:78 scripts/phase-gate-review.sh:97 scripts/phase-gate-review.sh:108 scripts/phase-gate-review.sh:132 scripts/phase-gate-review.sh:134 scripts/phase-gate-review.sh:142 scripts/phase-gate-review.sh:180 scripts/phase-gate-review.sh:181 scripts/phase-gate-review.sh:183 scripts/phase-gate-review.sh:185 scripts/validate-config.sh:49 scripts/validate-config.sh:61
⚙️ 外部命令 (50)
scripts/check-status.sh:28 scripts/check-status.sh:31 scripts/check-status.sh:49 scripts/check-status.sh:50 scripts/check-status.sh:51 scripts/check-status.sh:55 scripts/check-status.sh:58 scripts/check-status.sh:61 scripts/check-status.sh:1 scripts/init-project.sh:19 scripts/init-project.sh:137 scripts/init-project.sh:1 scripts/install.sh:66 scripts/install.sh:97 scripts/install.sh:192 scripts/install.sh:196 scripts/install.sh:201 scripts/install.sh:1 scripts/phase-gate-review.sh:102 scripts/phase-gate-review.sh:34 scripts/phase-gate-review.sh:41 scripts/phase-gate-review.sh:43 scripts/phase-gate-review.sh:92 scripts/phase-gate-review.sh:124 scripts/phase-gate-review.sh:161 scripts/phase-gate-review.sh:165 scripts/phase-gate-review.sh:170 scripts/phase-gate-review.sh:177 scripts/phase-gate-review.sh:1 scripts/validate-config.sh:94 scripts/validate-config.sh:106 scripts/validate-config.sh:123 scripts/validate-config.sh:145 scripts/validate-config.sh:153 scripts/validate-config.sh:164 scripts/validate-config.sh:1 SKILL.md:27-29 SKILL.md:29-33 SKILL.md:33-34 SKILL.md:34 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42 SKILL.md:58 SKILL.md:59-60 SKILL.md:60 SKILL.md:61 SKILL.md:63-69 SKILL.md:69-72 SKILL.md:72-76
偵測到的模式
Pipe to shell pattern×2
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/supercent-io-bmad-orchestrator/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/supercent-io-bmad-orchestrator?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/supercent-io-bmad-orchestrator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supercent-io-bmad-orchestrator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/supercent-io-bmad-orchestrator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
supercent-io. (2026). bmad-orchestrator security audit report (audit version 6) [Author version 1.2.0]. Skillstore. https://skillstore.io/skills/supercent-io-bmad-orchestrator/audits/6BibTeX 引用
@techreport{supercent-io-supercent-io-bmad-orchestrator-2026,
author = {supercent-io},
title = {bmad-orchestrator security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/supercent-io-bmad-orchestrator/audits/6},
note = {Author version 1.2.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "bmad-orchestrator security audit report (audit version 6)"
version: "1.2.0"
type: report
authors:
- name: "supercent-io"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/supercent-io-bmad-orchestrator/audits/6"
identifiers:
- type: other
value: "skillstore:supercent-io-bmad-orchestrator:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 59
架構
100
可維護性
85
內容
69
社群
91
規範符合度
你可以打造什麼
標準化功能規劃
在工程師與 agents 開始實作工作前，定義共用的 BMAD 階段路徑。
恢復 BMAD 專案
檢查工作流程狀態，並識別下一個必要的規劃或實作步驟。
審查階段交付項目
透過結構化審查閘門傳送 PRDs、架構筆記或 sprint plans。
試試這些提示
初始化專案
在此 repository 中為名為 <project> 的 web app 初始化 BMAD。若缺少任何 level 或 output folder 選項，請詢問我。
檢查目前狀態
檢查 BMAD workflow status，並告訴我下一個必要階段、被封鎖的項目，以及我應該執行的 command。
審查階段文件
使用 phase gate process 審查目前的 PRD，然後在進入 architecture 前摘要必要變更。
規劃跨工具協調
針對具備 Codex orchestration、plannotator review 與 sprint handoff checkpoints 的 level 3 integration project，調整 BMAD phase plan。
最佳實務
- 在執行 setup scripts 前，先審查 installer 與 network actions。
- 在產生新的 BMAD artifacts 前，先執行 workflow status。
- 在 gate review 前，將每個階段文件納入 version control。
避免
- 在無人值守環境中執行 remote installers。
- 因工具缺失而跳過階段審查。
- 未協調 config 與 deliverables 就手動編輯 workflow status。
常見問題
這個技能的用途是什麼？
它會為 AI 輔助軟體專案協調 BMAD workflow setup、status checks、phase routing 與 review gates。
它可以搭配 Codex 使用嗎？
可以，但 Codex usage 被記錄為 orchestration integration，而不是預設原生路徑。
它會建立專案文件嗎？
不會。它會追蹤 workflow status 並引導階段，但 BMAD document generation 會透過相關 commands 或 agents 進行。
為什麼它使用 plannotator？
plannotator 為 PRDs、architecture notes 與其他 phase deliverables 提供 visual review gate。
需要 shell access 嗎？
是。包含的 setup、validation、status 與 review helpers 都是 shell scripts。
團隊在安裝前應審查什麼？
團隊在執行 scripts 前，應審查 remote installer commands、plannotator data handling 與 hook setup。
開發者詳細資訊
作者
supercent-io授權
MIT
作者版本
v1.2.0
Skillstore 修訂
r1
引用
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
維護新鮮度
2026/7/18
使用量
10 次下載 · 156 次瀏覽