failure-path-audit-beads
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it processes untrusted data and uses it to perform actions with shell capabilities.
- Ingestion points: In Phase 1, the agent is instructed to "Review the actual codebase, components, error handling, and UI states" to perform the audit. This data source is external and potentially attacker-controlled.
- Boundary markers: No boundary markers or delimiters are specified to isolate the content of audited files from the agent's core instructions.
- Capability inventory: In Phase 2, the skill uses the
bd(Beads) CLI tool to execute shell commands such asbd create,bd update, andbd init. These commands are used to translate audit findings into trackable tasks. - Sanitization: Findings extracted from the codebase (e.g.,
<finding-title>,<location and context>,<fix recommendation>) are interpolated directly into shell command arguments. The instructions do not specify any sanitization or escaping of shell metacharacters, creating a risk of command injection if a malicious file name or code comment is interpreted as a finding title. - [COMMAND_EXECUTION]: The skill relies on executing shell commands via the
bdCLI to integrate with the Beads task tracker. While these commands are part of the intended functionality, the lack of input sanitization for variables derived from the audited codebase creates a surface for command injection.
Audit Metadata