Search skills/

BMad Method agent skills

An agile delivery method for coding agents: 35 skills for role personas, planning, architecture, build, review and retrospectives, with Python helper scripts.

bmad-code-org/BMAD-METHOD 35 skills Planning, TDD & debuggingSkill & agent tooling

with caveats

A deep, actively maintained process pack, but the main branch is a v7 preview alpha with breaking changes, and it needs uv, Python and Node to run its scripts.

broad access: turns off safety prompts · runs unpinned remote code → security details

Depth
4/5
Last update
today
Installs
—
Stars
55K
Forks
6.1K
License
Unclear

What BMad Method does

BMad Method gives a coding agent an agile delivery process that scales with the size of the change. Small, clear changes go straight to bmad-build. Larger or vaguer work goes through clarification, planning and architecture first, and the decisions are saved as project context so later sessions don't need them explained again. The bmad hub skill answers questions, recommends the next skill based on what is installed, and handles setup, updates, migration and switching the active initiative. Persona skills cast the agent as a named role, such as Mary the business analyst, or an architect, PM, product owner, UX designer or developer. The persona stays active until you dismiss it. Other skills cover brainstorming, architecture documents, code review, an automated build variant, retrospectives, deep reconnaissance of an existing repo, and advanced elicitation, which runs methods like pre-mortem, first principles or red team against the agent's most recent output. Many skills call Python scripts through uv. One example is a customization resolver that merges customize.toml defaults with team and personal overrides under _bmad/custom/. Several scripts have pytest suites, and the toolsmith, customize and eval skills let you build and test your own skills.

Good for

  • Teams that want product, architecture and UX decisions written down before code
  • Bringing an agent into an existing codebase with verified context
  • Projects that run over many sessions and need decisions carried forward

Not for

  • Anyone who needs a stable install today and doesn't want to pin v6.12
  • Quick one-off fixes where personas and setup are overhead
  • Environments where you can't install uv, Python and Node

What's inside depth 4/5

35 skills averaging 5.7 KB of instructions across 584 files, with reference docs, templates, Python scripts and pytest suites in many skill folders, plus CI and a few eval files.

Skills
35
Reference docs
107
Scripts
80
Tests / evals
50
Templates
68
Avg SKILL.md
5.5 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • uv (required for BMad setup and its Python scripts)
  • Node.js 20.12+ and Python 3.10+ for the stable v6.12 npm installer
  • Node.js, npm and Git for the v7 skills CLI install

Security review

Security: Broad access

This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.

  • Turns off permission prompts or safety checksThe eval harness's documented command runs claude -p with --dangerously-skip-permissions, so eval sessions run without permission prompts.skills/bmad-eval/references/harness.md:22

BMAD-METHOD is a large collection of planning, architecture, ticketing and dev-workflow skills that run local Python scripts through uv and are installed via unpinned npx packages. The bundled eval harness is documented to launch claude with --dangerously-skip-permissions. Most code, including the setup script that makes a network request, was not reviewed here.

Worth knowing

  • Runs remote code at an unpinned versionWhen BMad is not set up, skills offer to run npx skills add bmad-code-org/BMAD-METHOD --skill bmad at an unpinned version.skills/bmad-advanced-elicitation/SKILL.md:18
  • Relies on a CLI or package we could not reviewInstallation relies on the npm packages bmad-method and skills run through npx; their code is not in this repo.README.md:25
  • Makes network requestsThe setup script makes an HTTP request with urllib.request.urlopen; the endpoint was not reviewed.skills/bmad/scripts/setup.py:1958

What we checked

The repository (584 files) on Nov 1, 2026. Not a full review: 128 of 584 files were not downloaded (large repository; we reviewed the skill folders); we read 6 of 80 code files; it relies on code outside the repository: 72 of 80 code files, including skills/bmad/scripts/setup.py (network request, project setup), render_skill.py (prints the workflow that several skills follow), migrate_v6.py, memlog.py, knowledge.py, skills/bmad-deep-recon/scripts/recon_kit.py (reads os.environ), skills/bmad-toolsmith/scripts/read_session_log.py (reads Claude session logs), and skills/bmad-eval/scripts/run_evals.py / run_triggers.py; skills/bmad-agent-po/scripts/tickets.py and its test file (text truncated in the dossier); 128 readable repo files not provided (e.g. .github workflows, .github/scripts/discord-helpers.sh, ticket-store config starters).

NVIDIA SkillSpector static scan: 217 pattern hits (MCP Rug Pull 86, Dangerous Code Execution 60, Excessive Agency 38, Data Exfiltration 14, Privilege Escalation 7, Agent Snooping 5). The env-variable 'harvesting' hits in the test files build subprocess environments for the skill's own scripts. The 'secret.txt' hits are path-traversal test fixtures. Subprocess hits in tests invoke the skill's own scripts, the 'MCP rug pull' hits are unpinned npx bmad-method / npx skills install commands, and the prompt-injection and anti-refusal hits are ordinary prose or template HTML comments. The recon_kit.py os.environ hit and the setup.py network call are in files we did not read.

A review, not a certification. Skills change after we check them — read the files before installing.

License

The README states MIT (commercial use allowed) and links a LICENSE file. GitHub's license detection reports NOASSERTION, so check the LICENSE file before relying on it.

Can it run unattended?

Not really. Most of the method is interactive and persona-driven. A bmad-build-auto skill exists with a subagent review step, but the dossier does not document its stop conditions or resumable state, and v7 is still alpha.

Alternatives to BMad Method

Superpowers

obra/superpowers

A 15-skill development methodology that makes coding agents clarify the goal, write a plan, work through it with subagents and verify before calling it done.

recommended Security: Check first depth3/5

Compound Engineering

EveryInc/compound-engineering-plugin

Every's plugin of 36 skills for a brainstorm, plan, build, review and capture-the-learning loop, with an optional hands-off /lfg pipeline.

recommended Security: Broad access depth4/5

Agent Skills (Addy Osmani)

addyosmani/agent-skills

25 engineering-lifecycle skills and 9 slash commands (spec, plan, build, test, review, ship) that make coding agents follow senior-engineer workflows.

recommended Security: Check first depth3/5

Matt Pocock's Skills

mattpocock/skills

Small, composable engineering skills: grill-me interviews, shared glossary, TDD, triage, prototyping, code review, handoff and a flow router.

recommended Security: Check first depth2/5

FAQ

What is BMad Method?

BMad Method (Breakthrough Method for Agile Ai Driven Development) is an open-source set of agent skills that adds an agile delivery process to coding agents. It sizes the process to the change, offers role personas such as analyst, PM, architect, UX designer and developer, and keeps product and technical decisions as context for later work.

How do I install BMad Method?

For the stable v6.12 release, run npx bmad-method install in your project. It needs Node.js 20.12+, Python 3.10+ and uv. For the v7 preview, run npx skills add bmad-code-org/BMAD-METHOD --skill '*', or add the bmad-code-org/bmad-plugins marketplace in Claude Code or Codex and install bmad-method and bmad-core-tools. Then ask the bmad skill to run bmad setup.

Should I use BMad v6.12 or v7?

The README recommends v6.12 if you need stability. It is frozen apart from bug fixes. V7 is a preview alpha on the main branch whose skills, install path and docs change often, and the README recommends it for solo developers or small teams that can absorb breaking changes. The README gives mid-November 2026 as the v7 release ETA.

Is BMad Method safe to install?

The scanner hits we reviewed are pattern matches in tests, templates and help text, not hidden network calls or credential theft. The skills do run local Python scripts through uv, and setup runs npx skills update, so review the scripts if your environment restricts local execution.

BMad Method vs Superpowers: which should I use?

Both make the agent plan before coding. BMad adds named role personas, project-level configuration under _bmad/, and customization files, and it depends on uv and Python scripts. Superpowers is mostly instructions with a brainstorm, plan, execute and verify loop. Pick BMad if you want role-based agile artifacts, Superpowers if you want a lighter process pack.

Curated by , AI enthusiast. Reviews are written by AI reviewers under our rubric and checked against the repository files.

Sources: GitHub repository (stars, license, file tree, last push Nov 1, 2026). Review based on the README and SKILL.md files as published.