dstack-beads-plan-feature
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands using the
dstackandbd(Beads) CLI tools. It passes variables such as<title>,<slug>,<selector>, and<id>directly into shell strings. While the instructions explicitly advise using--body-fileto handle multiline data safely and avoid shell syntax issues, single-line variables remain potential vectors for command injection if the underlying agent platform does not perform automatic sanitization. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to perform its task.
- Ingestion points: The skill is instructed to inspect architecture diagrams, product documentation, source code, and test files in the
SKILL.mdworkflow. - Boundary markers: No explicit delimiters or boundary markers are defined for the analysis of these external files.
- Capability inventory: The skill has the capability to execute shell commands via the
dstackandbdbinaries and create/write temporary Markdown files. - Sanitization: The skill includes a mitigation strategy for multiline content by using the
--body-fileflag to persist intent as data rather than shell syntax, though it does not specify sanitization for metadata fields like titles or selectors.
- Ingestion points: The skill is instructed to inspect architecture diagrams, product documentation, source code, and test files in the
Audit Metadata