beaker-setup
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCECREDENTIALS_UNSAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies extensively on shell commands to interact with the
beakerCLI and Git. It automates authentication (beaker auth status), project initialization (beaker init), agent configuration (beaker agent setup), and execution of smoke tests and hosted runs. - [EXTERNAL_DOWNLOADS]: The skill uses
uvxto fetch and execute thebeaker-sdkpackage andnpxto update skill definitions. These commands download code from public registries at runtime. - [PERSISTENCE]: The skill is instructed to autonomously create new Git branches (e.g.,
beaker/YYYYMMDD-HHMM-agent-name) and push them to the remote repository (git push) without per-action user confirmation. This behavior is intended for onboarding but represents a high level of agent autonomy. - [CREDENTIALS_UNSAFE]: The skill manages project secrets, including API keys for various LLM providers and database credentials. It directs the agent to store these in
.beaker/.envfiles and uses CLI flags like--value-stdinto prevent secrets from appearing in shell history, which are positive security practices, but it still handles sensitive data directly. - [DYNAMIC_EXECUTION]: The integration templates provided in the skill (
repository_integration.py,combined_integration.py) are designed to dynamically load and execute Python code from the repository being optimized during evaluation cycles. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill reads and interprets project configuration files (
pyproject.toml,beaker.yaml), source code, and user-provided datasets to generate integration logic. - Boundary markers: The instructions do not define specific delimiters or "ignore" warnings when the agent processes these external files.
- Capability inventory: The agent has capabilities for file system modification, command execution, and remote repository updates (
git push). - Sanitization: There is no explicit requirement for the agent to sanitize or validate the content of ingested files before using them to construct shell commands or integration scripts.
Audit Metadata