dstack-beads-implement-feature
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the dstack command-line tool via a relative path ({baseDir}/../../bin/dstack) to claim tasks, commit code, and finalize feature work.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain malicious instructions. 1. Ingestion points: Step 2 involves reading external 'Beads' and 'accepted design' documents. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the workflow. 3. Capability inventory: The agent has the capability to write code and tests (Step 3) and execute subprocess commands via the dstack CLI (Steps 1, 6, and 7). 4. Sanitization: There is no evidence of sanitization or content validation for the external task data before it is used to guide implementation decisions.
Audit Metadata