beans
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users and agents to install the
beansCLI tool from a community-maintained GitHub repository (hmans/beans) using package managers like Homebrew (brew install hmans/beans/beans) or Go (go install github.com/hmans/beans@latest). - [COMMAND_EXECUTION]: The core functionality of the skill relies on executing the
beansCLI utility to perform file system operations within the.beans/directory, including creating, listing, and updating markdown files. - [INDIRECT_PROMPT_INJECTION]: The skill defines a triage workflow that involves reading and interpreting instructions from the bodies of "beans" (tasks or bug reports). Since these can be populated from external sources like user input or automated error reports, they represent an injection surface if the agent treats embedded instructions as authoritative.
- Ingestion points: Data enters the agent's context through
beans listandbeans showcommands reading task bodies inSKILL.mdandreferences/cli.md. - Boundary markers: No explicit delimiters or "ignore embedded instructions" warnings are defined for the task body content.
- Capability inventory: The skill executes shell commands via the
beansCLI and performs file reads/writes in the repository. - Sanitization: No sanitization or validation of the content within the task bodies is specified before processing by the agent.
- [DATA_EXPOSURE]: During the triage phase described in
SKILL.md, the skill instructs the agent to scan agent-specific configuration paths (.agents/skills/and~/.agents/skills/) to discover and match relevant skills to tasks.
Audit Metadata