suede-graph-flo-xr
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository files and user-provided scope descriptions, which creates a surface for indirect prompt injection. Robust mitigation strategies are present, including explicit boundary markers in agent prompts (treating all inputs as untrusted data), strict path validation using regex to prevent escape or injection, and shell argument quoting for all subprocess calls.
- [DYNAMIC_EXECUTION]: The workflow uses a helper script to generate and execute a Python shim for process monitoring. This shim utilizes standard Foreign Function Interface (FFI) calls via the
ctypeslibrary to interact with system APIs. This is a legitimate technical workaround for sandbox limitations and is not used for malicious code execution. - [EXTERNAL_DOWNLOADS]: The workflow performs repository updates via
git fetchand utilizes web search and fetch tools to gather evidence. These capabilities are restricted to specific sub-agents with limited toolsets. Acceptance commands are executed within a highly restrictivesandbox-execprofile on macOS that explicitly denies network access.
Audit Metadata