beads
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it retrieves task instructions and context from the
bdissue tracker output. An attacker with access to the issue database could inject malicious instructions into issue descriptions or notes that the agent might subsequently execute. - Ingestion points: Ingestion occurs through the
bd ready,bd show, andbd primecommands as referenced inSKILL.mdandresources/PATTERNS.md. - Boundary markers: The skill lacks explicit delimiters or instructions for the agent to treat issue content as untrusted data.
- Capability inventory: The agent possesses the ability to execute shell commands and modify the filesystem to perform its primary development tasks.
- Sanitization: There is no evidence of sanitization or validation of the text retrieved from the issue database.
Audit Metadata