dstack-beads-review-feature-spec
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using placeholders for user-supplied input (e.g.,
<selector>,<base>,<title>,<temporary-description>). If the agent populates these placeholders with unsanitized content, it could lead to arbitrary shell command execution. - [INDIRECT_PROMPT_INJECTION]: The skill reads and reconciles content from the repository, including source code, documentation, and dependencies, and incorporates this information into a design document.
- Ingestion points: The skill reads the complete repository context, including
docs/src/features/<slug>/design.md, source code, tests, and documentation files within the worktree. - Boundary markers: There are no explicit instructions or delimiters mentioned to prevent the agent from following instructions potentially embedded in the repository's data files.
- Capability inventory: The skill has the ability to write to files (
design.md), execute thedstackbinary, and performgit commitoperations. - Sanitization: The skill does not define any sanitization or validation steps for the content read from the repository before it is processed or used in commands.
Audit Metadata