beads-br
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's core functionality is built around the execution of shell commands, including
brfor issue tracking,bvfor visualization, andgitfor synchronization. It uses subshells to resolve repository paths (e.g.,BEADS_DIR="$(ao beads dir)"). - [EXTERNAL_DOWNLOADS]: The command reference in
references/COMMANDS.mdincludes thebr upgradecommand. This utility allows the tool to download and install updates from the vendor's sources, representing a standard maintenance capability that involves network-based software updates. - [PROMPT_INJECTION]: The conversion and polishing workflows defined in
references/PROMPTS.mdinstruct the agent to read and process content from external markdown plan files. This creates a surface for indirect prompt injection: - Ingestion points: External markdown files (e.g.,
[YOUR_PLAN_FILE].md) ingested into the agent context for task conversion. - Boundary markers: Absent; the prompt templates do not include delimiters or specific instructions to ignore embedded commands or malicious instructions within the user-provided text.
- Capability inventory: The agent uses the processed content to execute
br create,br update, andbr dep addcommands. - Sanitization: Absent; the skill relies on the model's interpretation of the markdown content without pre-processing or validation of the input text.
Audit Metadata