bmad-code-org/bmad-method bmad
Checked the catalogued skill at bmad.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
11 suppressed by AI triage
The command runs a local script to gather help, not a DNS lookup or data exfiltration.
The file is documentation describing a setup script; it does not contain active DNS lookup code or dynamic hostnames indicative of exfiltration.
Only imports urllib.request; no network I/O is performed.
The line defines a CLI argument, not a post‑install hook.
Only a string manipulation of a GitHub URL, not an actual network call.
Defines a function for reporting; no post‑install hook.
Creates a raw GitHub URL string, no network request performed.
Defines a parsing function; not a lifecycle hook.
Documentation config example, not an active outbound call.
Documentation merely references outbound network call patterns, not executing or configuring them.
The file only contains documentation text about a detected outbound network call, with no actual code or permission grant present.