beads

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it retrieves task instructions and context from the bd issue tracker output. An attacker with access to the issue database could inject malicious instructions into issue descriptions or notes that the agent might subsequently execute.
  • Ingestion points: Ingestion occurs through the bd ready, bd show, and bd prime commands as referenced in SKILL.md and resources/PATTERNS.md.
  • Boundary markers: The skill lacks explicit delimiters or instructions for the agent to treat issue content as untrusted data.
  • Capability inventory: The agent possesses the ability to execute shell commands and modify the filesystem to perform its primary development tasks.
  • Sanitization: There is no evidence of sanitization or validation of the text retrieved from the issue database.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 04:15 PM
Security Audit — agent-trust-hub — beads