implement-task
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from issue descriptions and metadata retrieved via the 'bd show' command. An attacker could embed malicious instructions in these descriptions to influence the agent's behavior during implementation or validation phases. \n
- Ingestion points: Issue descriptions and metadata fields in SKILL.md. \n
- Boundary markers: The skill explicitly requires path validation against the repository root but does not instruct the agent to disregard instructions found within the processed task content. \n
- Capability inventory: The skill uses Bash, Write, Edit, and Task tools, allowing for file system modifications and command execution. \n
- Sanitization: Path validation is enforced to prevent directory traversal, but content-level sanitization is not specified. \n- [COMMAND_EXECUTION]: The skill frequently executes shell commands and Python scripts using 'uv run', including 'beads-workflow-lock.py', 'check-docs.py', and 'reconcile-beads-interactions.py'. These are local scripts within the project or core directory. \n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill uses 'npx skills update', which can fetch and execute the 'skills' package from the npm registry. While common in developer workflows, this represents an external code dependency execution point.
Audit Metadata