beat-scheduling
Warn
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell scripts
scripts/test-beat.shandscripts/validate-schedule.shthat automate the testing and validation of the Celery environment by executing local commands and dynamically generating Python code to inspect application configuration. - [PROMPT_INJECTION]: The template
templates/dynamic-schedules.pyimplements a pattern for loading task schedules from external JSON files, which introduces an indirect prompt injection surface where a malicious configuration file could be used to execute unauthorized tasks within the task queue. - Ingestion points: External JSON configuration files (e.g.,
schedules.json) loaded viaload_schedule_config. - Boundary markers: None identified in the provided templates to isolate external configuration from the execution logic.
- Capability inventory: The skill uses
sender.add_periodic_taskandapp.signaturewhich are capable of triggering any registered task. - Sanitization: No validation or sanitization logic is implemented for the task signatures or arguments ingested from the external files.
Audit Metadata