conceptual-model-beads
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to generate and run shell commands (e.g.,
bd update,bd create) that include variables like<arguments>,<finding-title>, and<evidence>. These values are sourced from user input or extracted from the analyzed repository. Since the skill does not require escaping or sanitizing these strings, an attacker could provide input or code containing shell metacharacters (e.g.,;,|, backticks) to execute arbitrary commands in the agent's environment. - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) due to its data processing flow.
- Ingestion points: The skill reads repository files, prototype code, and documentation (SKILL.md, Phase 1).
- Boundary markers: There are no delimiters or instructions to treat repository content as untrusted data.
- Capability inventory: The skill uses the
bdCLI tool and general shell execution to manage issues. - Sanitization: Findings extracted from the codebase are placed directly into issue descriptions and notes used in shell commands without sanitization or validation.
Audit Metadata