prototype-hci-pack-beads
Fail
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
bdCLI to create and update issues by interpolating variables like<finding-title>,<description>, and<evidence>directly into shell command strings (e.g.,bd create "[MAJOR] <finding-title>"). Since these values are extracted from untrusted repository content, screenshots, and documentation, a malicious file could contain shell metacharacters (e.g., backticks or semicolons) that trigger arbitrary command execution on the host system.\n- [EXTERNAL_DOWNLOADS]: The skill references thebeads-clipackage and provides a link to thesteveyegge/beadsrepository on GitHub for installation. These are well-known technology resources in the developer community.\n- [PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection through the ingestion of untrusted repository data.\n - Ingestion points: Current repository files, screenshots, and documentation processed during the HCI review phase in SKILL.md.\n
- Boundary markers: Absent; there are no delimiters or specific instructions to the agent to treat external content as untrusted or to ignore embedded commands.\n
- Capability inventory: The skill performs shell command execution using the
bdCLI tool.\n - Sanitization: Absent; findings are interpolated into shell commands without validation, escaping, or filtering.
Recommendations
- AI detected serious security threats
Audit Metadata