state-model-beads
Fail
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
bdCLI. It uses unsafe string interpolation to include user arguments and repository content (e.g.,<arguments>,<branch>, and<what/why + evidence>) directly into the command line (e.g.,bd update <id> --notes "... <arguments>"). This allows for arbitrary command execution if the input contains shell metacharacters like double quotes, backticks, or semicolons. - [PROMPT_INJECTION]: The skill analyzes repository content to define state machines and create issues, exposing it to indirect prompt injection.
- Ingestion points: The agent reads repo files, routes, components, database schemas, and API endpoints in SKILL.md Phase 1.
- Boundary markers: None are specified to protect against malicious instructions embedded in the analyzed code.
- Capability inventory: The agent performs shell command execution via the
bdtool (init, create, update, dep add). - Sanitization: No sanitization or escaping of the ingested data is defined before it is used to generate command arguments.
- [EXTERNAL_DOWNLOADS]: The skill recommends that users install the
beads-clipackage from an external repository (https://github.com/steveyegge/beads) if the tool is not already present on the system.
Recommendations
- AI detected serious security threats
Audit Metadata