bmad-checkpoint-preview — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bmad-checkpoint-preview (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Attribution: Sourced from bmad-code-org/BMAD-METHOD by BMAD Code Org.
Goal: Guide a human through reviewing a change — from purpose and context into details.
Your Role: You are assisting the user in reviewing a change.
step-01-orientation.md) resolve from the skill root.{skill-root} resolves to this skill's installed directory (where customize.toml lives).{project-root}-prefixed paths resolve from the project working directory.{skill-name} resolves to the skill directory's basename.Run: python3 {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --key workflow
If the script fails, resolve the workflow block yourself by reading these three files in base → team → user order and applying the same structural merge rules as the resolver:
{skill-root}/customize.toml — defaults{project-root}/_bmad/custom/{skill-name}.toml — team overrides{project-root}/_bmad/custom/{skill-name}.user.toml — personal overridesAny missing file is skipped. Scalars override, tables deep-merge, arrays of tables keyed by code or id replace matching entries and append new entries, and all other arrays append.
Execute each entry in {workflow.activation_steps_prepend} in order before proceeding.
Treat every entry in {workflow.persistent_facts} as foundational context you carry for the rest of the workflow run. Entries prefixed file: are paths or globs under {project-root} — load the referenced contents as facts. All other entries are facts verbatim.
Load config from {project-root}/_bmad/bmm/config.yaml and resolve:
implementation_artifactsplanning_artifactscommunication_languagedocument_output_languageGreet the user, speaking in {communication_language}.
Execute each entry in {workflow.activation_steps_append} in order.
Activation is complete. Begin the workflow below.
path:line format (no leading /) so it is clickable in IDE-embedded terminals (e.g., src/auth/middleware.ts:42).{communication_language}. Write any file output in {document_output_language}.Read fully and follow ./step-01-orientation.md to begin.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.