beads
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the Beads CLI tool from established software registries.
- References the
@anthropic/beadspackage on the NPM registry for global installation. - Provides configuration for the
misetool to download multi-architecture binaries directly from GitHub releases. - Supports source-based installation via the Go toolchain targeting the
steveyegge/beadsrepository. - [COMMAND_EXECUTION]: Defines a robust set of automation scripts and agent workflows for interacting with the issue tracker.
templates/mise.tomlcontains numerous Nushell scripts that wrap thebdCLI to manage task lifecycles, dependencies, and sync operations.agents/beads-worker.mdprovides a structured workflow for an agent to claim, execute, and close tasks using shell commands and git operations.- [PROMPT_INJECTION]: Contains a vulnerability surface for indirect prompt injection within the automated worker agent.
- Ingestion points: The
beads-workeragent reads external data from the issue tracker (titles, descriptions, and labels) via thebd show <task_id> --jsoncommand. - Boundary markers: There are no explicit delimiters or instructions to treat task-provided content as data rather than instructions.
- Capability inventory: The worker agent has extensive permissions including file system modification (
Write,Edit), shell execution (Bash), and the ability to delegate to subagents. - Sanitization: The skill does not implement sanitization or validation of the task descriptions before they are used to determine the agent's implementation steps.
Audit Metadata