suede-clip-to-guide
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including video transcripts, source metadata, and guide drafts to create content packages.\n
- Ingestion points: External content enters the context via source URLs and transcripts during the 'Define the funnel contract' step in SKILL.md.\n
- Boundary markers: The skill uses a structured markdown template (references/package-template.md) and explicit 'HALT' formatting for error conditions to isolate external data from instructions.\n
- Capability inventory: The agent is instructed to execute a bundled Python validation script (scripts/validate_package.py) to check output integrity.\n
- Sanitization: Mitigation strategies include the 'Claim gate' for factual verification, the 'Approval gate' for final content review, and a 'Dual Certainty Gate' that requires independent evidence checks in high-assurance modes.\n- [COMMAND_EXECUTION]: The skill directs the agent to execute a bundled Python script to validate generated markdown packages.\n
- Evidence: The command 'python3 scripts/validate_package.py' is used to verify the consistency of the final output. The script code was reviewed and found to use only standard libraries for static analysis, with no network or dangerous filesystem operations.\n- [EXTERNAL_DOWNLOADS]: The skill references documentation from trusted sources to assist with copyright and policy reviews.\n
- Evidence: Links to 'copyright.gov' and 'help.x.com' are provided in references/third-party-video-rights.md for informational purposes.
Audit Metadata