research-step

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The init workflow (workflows/init.md Step 1) explicitly tells the agent to "fetch the install docs at run time" from the public GitHub page (https://github.com/gastownhall/beads) to decide how to install bd, which requires reading and acting on open third‑party content that can change installation commands and thus materially influence tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The init workflow explicitly tells the agent to fetch and consult https://github.com/gastownhall/beads at runtime (and potentially use "the project's install script") to decide how to install bd, meaning remote content from that URL can directly determine commands run or be executed during installation.