dstack-beads-project-alignment-execute
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local binary
dstackusing a relative path"{baseDir}/../../bin/dstack". This tool is used to manage and commit project 'alignment' corrections. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting and acting upon untrusted external data.
- Ingestion points: Data enters the context through the
alignment claim-nextcommand, which retrieves 'Beads' containing correction instructions. - Boundary markers: There are no explicit delimiters or instructions to the agent to treat the content of the Beads as untrusted data rather than instructions.
- Capability inventory: The skill allows the agent to modify the file system (implementing corrections) and perform repository operations (
git commit). - Sanitization: The skill includes a revalidation step to check if the finding is obsolete, but it does not specifically sanitize the input for malicious instructions targeting the LLM.
Audit Metadata