suede-agent-teams
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The orchestrator processes untrusted external data, including GitHub issues, pull request content, and repository source code. This creates a surface area for indirect prompt injection attacks.\n
- Ingestion points: External repository files, GitHub issue descriptions, and PR metadata processed via the Scout and Builder roles (defined in SKILL.md and references/public-contribution-program.md).\n
- Boundary markers: The skill uses a 'Status Vocabulary' and 'Team Contract' to define specific boundaries for agent actions.\n
- Capability inventory: The skill uses agents that can execute shell commands, write files, and perform Git operations.\n
- Sanitization: The scripts/contribution-ledger.mjs tool includes an artifact-check command that uses regex patterns to lint for and block outward-copy violations and automated tool markers, and the Gate policy requires human review for high-risk findings.\n- [COMMAND_EXECUTION]: The provided management script (scripts/contribution-ledger.mjs) uses execFileSync to interact with git and ps.\n
- These calls are used for legitimate orchestration tasks: verifying repository status, creating worktrees, and checking if process IDs associated with file locks are still active.
Audit Metadata