bmm-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bmm-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is the top-level entry point for the BMad Method framework installed under .claude/skills/bmm-skills/. It does not contain workflow logic. Its job is to route the agent to the correct sub-skill folder based on the user's intent and to expose the four-phase mental model.
The framework is organized in four sequential phases. Each phase produces artifacts the next phase consumes:
1-analysis/ → discovery, research, problem framing
2-plan-workflows/ → PRDs, UX specs (the "what")
3-solutioning/ → architecture, epics & stories (the "how")
4-implementation/ → story execution, review, sprint tracking (the "ship")Module-level configuration (output folders, user skill level, full agent roster with personas) lives in module.yaml at the root of this folder. Read it once at the start of any BMad session to load shared variables ({output_folder}, {planning_artifacts}, {implementation_artifacts}, {project_knowledge}).
SKILL.md and follow its instructions.customize.toml on activation — you don't need to do that here.Don't dump the whole framework into context. Read only the sub-skill that matches the current request, plus any artifacts it needs.
1-analysis/)Discovery, research, and problem framing. Outputs feed the planning phase.
| Trigger | Sub-skill | Read |
|---|---|---|
| "Talk to Mary" / "I need the business analyst" | Persona — Mary | 1-analysis/bmad-agent-analyst/SKILL.md |
| "Talk to Paige" / "I need the tech writer" | Persona — Paige | 1-analysis/bmad-agent-tech-writer/SKILL.md |
| "Create a product brief" / "Update my product brief" | Workflow | 1-analysis/bmad-product-brief/SKILL.md |
| "Create a PRFAQ" / "Work backwards" / "Run the PRFAQ challenge" | Workflow | 1-analysis/bmad-prfaq/SKILL.md |
| "Document this project" / "Generate project docs" (brownfield) | Workflow | 1-analysis/bmad-document-project/SKILL.md |
| "Run market research" / "Research my competition" | Workflow | 1-analysis/research/bmad-market-research/SKILL.md |
| "Run domain research" / "Research this industry" | Workflow | 1-analysis/research/bmad-domain-research/SKILL.md |
| "Run technical research" / "Research this technology" | Workflow | 1-analysis/research/bmad-technical-research/SKILL.md |
Typical entry points: new green-field idea → bmad-product-brief or bmad-prfaq; existing codebase the team needs to onboard → bmad-document-project.
2-plan-workflows/)Turn the analysis into a Product Requirements Document and UX specs. Owned by John (PM) and Sally (UX).
| Trigger | Sub-skill | Read |
|---|---|---|
| "Talk to John" / "I need the product manager" | Persona — John | 2-plan-workflows/bmad-agent-pm/SKILL.md |
| "Talk to Sally" / "I need the UX designer" | Persona — Sally | 2-plan-workflows/bmad-agent-ux-designer/SKILL.md |
| "Create a PRD" / "I want a new product requirements doc" | Workflow | 2-plan-workflows/bmad-create-prd/SKILL.md |
| "Edit this PRD" | Workflow | 2-plan-workflows/bmad-edit-prd/SKILL.md |
| "Validate this PRD" / "Run PRD validation" | Workflow | 2-plan-workflows/bmad-validate-prd/SKILL.md |
| "Create UX design" / "Plan the UX" / "Create UX specifications" | Workflow | 2-plan-workflows/bmad-create-ux-design/SKILL.md |
Pre-requisites: a product brief or PRFAQ from phase 1 (not strictly required, but the PRD workflow asks for one).
3-solutioning/)Translate the PRD + UX into technical architecture, epics and stories, and AI-agent context. Owned by Winston (architect).
| Trigger | Sub-skill | Read |
|---|---|---|
| "Talk to Winston" / "I need the architect" | Persona — Winston | 3-solutioning/bmad-agent-architect/SKILL.md |
| "Create architecture" / "Create technical architecture" / "Create a solution design" | Workflow | 3-solutioning/bmad-create-architecture/SKILL.md |
| "Create the epics and stories list" | Workflow | 3-solutioning/bmad-create-epics-and-stories/SKILL.md |
| "Generate project context" / "Create project context" | Workflow | 3-solutioning/bmad-generate-project-context/SKILL.md |
| "Check implementation readiness" / "Are we ready to ship?" | Workflow | 3-solutioning/bmad-check-implementation-readiness/SKILL.md |
Gate to phase 4: bmad-check-implementation-readiness is the last stop before development. If it surfaces gaps, loop back to phase 2 or 3 to close them.
4-implementation/)Execute approved stories, review, track sprints, retrospect. Owned by Amelia (dev).
| Trigger | Sub-skill | Read |
|---|---|---|
| "Talk to Amelia" / "I need the developer" | Persona — Amelia | 4-implementation/bmad-agent-dev/SKILL.md |
| "Build / fix / tweak / refactor / add / modify [anything]" — any code intent | Workflow | 4-implementation/bmad-quick-dev/SKILL.md |
| "Create the next story" / "Create story [id]" | Workflow | 4-implementation/bmad-create-story/SKILL.md |
| "Implement story [file]" / "Dev this story" / "Implement next story in sprint plan" | Workflow | 4-implementation/bmad-dev-story/SKILL.md |
| "Run code review" / "Review this code" | Workflow | 4-implementation/bmad-code-review/SKILL.md |
| "Generate QA tests for [feature]" / "Create automated E2E tests" | Workflow | 4-implementation/bmad-qa-generate-e2e-tests/SKILL.md |
| "Run sprint planning" / "Generate sprint plan" | Workflow | 4-implementation/bmad-sprint-planning/SKILL.md |
| "Check sprint status" / "Show sprint status" | Workflow | 4-implementation/bmad-sprint-status/SKILL.md |
| "Correct course" / "Propose sprint change" | Workflow | 4-implementation/bmad-correct-course/SKILL.md |
| "Checkpoint" / "Human review" / "Walk me through this change" | Workflow | 4-implementation/bmad-checkpoint-preview/SKILL.md |
| "Run a retrospective" / "Retro the epic" | Workflow | 4-implementation/bmad-retrospective/SKILL.md |
Quick-dev vs. full pipeline: bmad-quick-dev is the catch-all for any code change request; it's a hardened single-pass workflow that produces a reviewable artifact. Use it when there is no formal story file. Use bmad-create-story → bmad-dev-story when the user wants the full BMad pipeline (story spec then implementation).
The framework defines six named personas. Each lives in a bmad-agent-* sub-skill that establishes identity + activation. When the user names an agent, route to the persona skill first; the persona then takes over and may invoke phase workflows.
| Agent | Phase | Role | Persona skill |
|---|---|---|---|
| Mary 📊 | 1 | Business Analyst — strategic rigor, evidence-grounded | 1-analysis/bmad-agent-analyst/SKILL.md |
| Paige 📚 | 1 | Technical Writer — CommonMark/DITA/OpenAPI master | 1-analysis/bmad-agent-tech-writer/SKILL.md |
| John 📋 | 2 | Product Manager — Jobs-to-be-Done, user value first | 2-plan-workflows/bmad-agent-pm/SKILL.md |
| Sally 🎨 | 2 | UX Designer — empathy + edge-case rigor | 2-plan-workflows/bmad-agent-ux-designer/SKILL.md |
| Winston 🏗️ | 3 | System Architect — boring tech, trade-offs over verdicts | 3-solutioning/bmad-agent-architect/SKILL.md |
| Amelia 💻 | 4 | Senior Software Engineer — TDD, file paths and AC IDs | 4-implementation/bmad-agent-dev/SKILL.md |
Full persona descriptions and module configuration (output folders, language settings, user skill level prompts) are in module.yaml.
All BMad sub-skills follow the same path conventions. Note these once and they apply everywhere:
references/guide.md) resolve from the sub-skill's root.customize.toml lives).On activation, every sub-skill resolves its customize.toml (with optional team and user overrides under {project-root}/_bmad/custom/). If the resolver script is unavailable, the sub-skill's SKILL.md explains how to merge the layers manually (base → team → user, scalars override, tables deep-merge, arrays of tables key-merge, other arrays append).
4-implementation/bmad-quick-dev/SKILL.md — it's the framework's catch-all.bmad-create-prd first; the user can chain bmad-validate-prd after.Don't preload more than one sub-skill at a time. The framework's progressive disclosure depends on it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.