to-epic
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a custom CLI tool 'bd' to publish epics to the Beads Issue Tracker. This is the core functionality of the skill and appears to be a legitimate vendor-provided tool for the target workflow.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates conversation context and repository information directly into the arguments of a shell command ('bd create'). There are no instructions for the agent to sanitize or escape these inputs, which could be exploited if the conversation context contains shell-sensitive characters like backticks or semicolons.
- Ingestion points: Conversation context and codebase understanding (SKILL.md).
- Boundary markers: No markers or sanitization logic are defined to protect the shell command from malicious input embedded in the context.
- Capability inventory: Shell command execution via the 'bd' tool with arguments for title, description, and acceptance criteria.
- Sanitization: No sanitization, escaping, or validation of inputs is specified before they are passed to the CLI tool.
Audit Metadata