beadboard-driver
Fail
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill runbook in
SKILL.mdinstructs the agent to clone a repository from an unverified source (https://github.com/zenchantlive/beadboard.git) and install it globally.\n- [REMOTE_CODE_EXECUTION]: The requirement to clone and globally install (npm install -g .) code from a non-trusted third-party repository constitutes a high-risk pattern that allows for the execution of arbitrary remote code.\n- [COMMAND_EXECUTION]: Several bundled scripts, includingscripts/bb-mail-shim.mjs,scripts/session-preflight.mjs, andscripts/setup-mail-delegate.mjs, utilizespawnSyncandexecFileto execute local shell commands and other tools (e.g.,bd,bb,npm,git).\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of external data. The agent is instructed to read and act on tasks and messages retrieved viabd queryandbd mail inboxwithout any evidence of sanitization or explicit boundary markers.\n - Ingestion points: External databases and mail systems accessed via
bd queryandbd mail inbox.\n - Boundary markers: Absent.\n
- Capability inventory: Shell command execution via
spawnSyncandexecFilein all utility scripts.\n - Sanitization: Absent.\n- [DATA_EXFILTRATION]: Utility scripts such as
scripts/lib/driver-lib.mjsandscripts/heal-common-issues.mjsaccess sensitive local files and directories, including~/.beadboard/and the.git/metadata folder, to manage state and configuration.
Recommendations
- AI detected serious security threats
Audit Metadata