Skills ralph-tui-create-beads-rust
📦
ralph-tui-create-beads-rust
Content revision r1 High Risk ⚙️ External commands
Convert PRDs Into Ralph TUI Beads
Large PRDs are difficult to turn into executable ralph-tui work. This skill converts PRD stories into beads with dependencies and quality gates.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "ralph-tui-create-beads-rust" from https://skillstore.io/skills/subsy-ralph-tui-create-beads-rust.md and its manifest at https://skillstore.io/api/skills/subsy-ralph-tui-create-beads-rust/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "ralph-tui-create-beads-rust". A PRD with one epic, three stories, and typecheck and lint gates.
Expected outcome:
- Epic bead for the feature.
- Three child beads with acceptance criteria.
- Dependencies from database work to backend work to UI work.
- Sync reminder for bead export.
Using "ralph-tui-create-beads-rust". A large dashboard PRD with broad user stories.
Expected outcome:
- Smaller story beads for schema, queries, components, filters, and summary views.
- Quality gates attached to every story.
- Dependency links that prevent UI work before backend work.
Using "ralph-tui-create-beads-rust". A PRD without a quality gates section.
Expected outcome:
A clarification request for required validation commands, followed by a conservative default plan when the user approves.
Security Audit
High Riskv5 • 7/7/2026 Open versioned report
Most static detections are false positives caused by Markdown backticks and fenced examples, not executable Ruby backtick usage. The real risk is the skill's actionable br command construction, where PRD-derived text is placed into shell command substitutions with a fixed heredoc delimiter. No prompt injection attempt was found in the reviewed SKILL.md content.
1
Files scanned
363
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Heredoc Delimiter Injection Risk
The skill places PRD-derived titles and descriptions inside fixed EOF heredocs that are wrapped in shell command substitution. A crafted PRD containing a standalone delimiter could break out of the intended description before br create runs.
The file explicitly takes PRD text and demonstrates command substitution with a fixed EOF delimiter. The risk depends on the agent executing those commands, so confidence is high but not absolute.
Low
Potential Version-Control Exposure of PRD Content
The skill instructs users to export bead data for git tracking after converting PRD stories into bead descriptions. Private product requirements can be exposed if the generated JSONL is committed to a shared repository.
The export and storage behavior is documented, and the bead descriptions come from PRD content. Exposure depends on repository sharing and commit practices, so this is a moderate-confidence contextual risk.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Shell command substitution
--description="$(cat <<'EOF'
The skill embeds PRD-derived descriptions into a shell command substitution using a fixed heredoc delimiter. Single-quoted heredocs reduce expansion, but delimiter collision can still let crafted text escape the description.
Medium
Shell command substitution
--description="$(cat <<'EOF'
The skill embeds PRD-derived descriptions into a shell command substitution using a fixed heredoc delimiter. Single-quoted heredocs reduce expansion, but delimiter collision can still let crafted text escape the description.
Medium
Shell command substitution
--description="$(cat <<'EOF'
The skill embeds PRD-derived descriptions into a shell command substitution using a fixed heredoc delimiter. Single-quoted heredocs reduce expansion, but delimiter collision can still let crafted text escape the description.
Medium
Shell command substitution
--description="$(cat <<'EOF'
The skill embeds PRD-derived descriptions into a shell command substitution using a fixed heredoc delimiter. Single-quoted heredocs reduce expansion, but delimiter collision can still let crafted text escape the description.
Medium
Shell command substitution
--description="$(cat <<'EOF'
The skill embeds PRD-derived descriptions into a shell command substitution using a fixed heredoc delimiter. Single-quoted heredocs reduce expansion, but delimiter collision can still let crafted text escape the description.
Medium
Shell command substitution
--description="$(cat <<'EOF'
The skill embeds PRD-derived descriptions into a shell command substitution using a fixed heredoc delimiter. Single-quoted heredocs reduce expansion, but delimiter collision can still let crafted text escape the description.
Medium
Template literal with command substitution
```bash
The fenced bash block shows br create commands using command substitution around PRD-derived text. This is actionable command construction, so crafted input could affect execution if delimiter handling fails.
Medium
Template literal with command substitution
```bash
The fenced bash block shows br create commands using command substitution around PRD-derived text. This is actionable command construction, so crafted input could affect execution if delimiter handling fails.
Risk Factors
⚙️ External commands (50)
SKILL.md:8 SKILL.md:10 SKILL.md:16 SKILL.md:21 SKILL.md:29-33 SKILL.md:33-34 SKILL.md:34-38 SKILL.md:38-41 SKILL.md:41-44 SKILL.md:44-50 SKILL.md:50-52 SKILL.md:52-71 SKILL.md:71-73 SKILL.md:73 SKILL.md:114-116 SKILL.md:116-118 SKILL.md:118-127 SKILL.md:127-129 SKILL.md:129-151 SKILL.md:151-170 SKILL.md:170-200 SKILL.md:200-208 SKILL.md:208-209 SKILL.md:209-237 SKILL.md:237-240 SKILL.md:240-303 SKILL.md:303-311 SKILL.md:311-313 SKILL.md:313-315 SKILL.md:315-321 SKILL.md:321-324 SKILL.md:324-330 SKILL.md:330-336 SKILL.md:336-349 SKILL.md:349-350 SKILL.md:350-356 SKILL.md:356 SKILL.md:358 SKILL.md:359 SKILL.md:360 SKILL.md:361 SKILL.md:362 SKILL.md:56-59 SKILL.md:66-69 SKILL.md:244-247 SKILL.md:253-257 SKILL.md:268-279 SKILL.md:288-298 SKILL.md:52-71 SKILL.md:240-303
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/subsy-ralph-tui-create-beads-rust/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/subsy-ralph-tui-create-beads-rust?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/subsy-ralph-tui-create-beads-rust?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/subsy-ralph-tui-create-beads-rust/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/subsy-ralph-tui-create-beads-rust.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
subsy. (2026). ralph-tui-create-beads-rust security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/subsy-ralph-tui-create-beads-rust/audits/5BibTeX citation
@techreport{subsy-subsy-ralph-tui-create-beads-rust-2026,
author = {subsy},
title = {ralph-tui-create-beads-rust security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/subsy-ralph-tui-create-beads-rust/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ralph-tui-create-beads-rust security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "subsy"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/subsy-ralph-tui-create-beads-rust/audits/5"
identifiers:
- type: other
value: "skillstore:subsy-ralph-tui-create-beads-rust:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Prepare PRD Execution
Turn a product requirements document into ordered beads that ralph-tui can execute with clear acceptance criteria.
Plan Agent-Sized Stories
Break broad features into small implementation tasks that fit one autonomous coding iteration.
Add Quality Gates
Carry test, lint, typecheck, and browser verification requirements into each generated bead.
Try These Prompts
Convert a PRD File
Use this skill to convert ./tasks/billing-prd.md into beads-rust tasks. Preserve the PRD quality gates and show the planned dependency order first.
Create Smaller Stories
Review this PRD and split any oversized user stories before creating beads. Keep each story small enough for one ralph-tui iteration.
Apply Custom Gates
Convert this PRD into br beads. Add npm run typecheck, npm run lint, and browser verification to every relevant acceptance checklist.
Build Dependency Chain
Create a beads-rust epic from this PRD and make dependencies explicit. Order schema work first, backend work second, and UI work last.
Best Practices
- Review the PRD for sensitive details before generating beads.
- Confirm quality gates before creating child tasks.
- Inspect generated dependency order before running ralph-tui.
Avoid
- Do not convert vague acceptance criteria without clarification.
- Do not create one bead for a full multi-area feature.
- Do not run generated shell commands without reviewing embedded PRD text.
Frequently Asked Questions
What does this skill create?
It creates a beads-rust epic, child story beads, acceptance criteria, quality gates, and dependency links for ralph-tui.
Does it require beads-rust?
Yes. It is written for the br CLI from beads-rust, not the original bd command.
Can it work from pasted PRD text?
Yes. It can use a PRD file or pasted markdown text as the source material.
How does it handle quality gates?
It extracts project validation steps from the PRD and appends them to relevant bead acceptance criteria.
Will it choose task dependencies?
Yes. It orders foundational work first and links later stories to their blockers.
What should users review before running commands?
Users should review generated descriptions, dependency order, quality gates, and any sensitive PRD text.