suede-launch-packaging
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the testing of software installation commands from a clean temporary directory. This is an intended feature to ensure release quality and installability for external users.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests data from external repositories and live URLs.
- Ingestion points: Reads content from README files, public repositories, and live URLs to verify launch readiness.
- Boundary markers: The skill does not explicitly define markers to delimit untrusted data from instructions.
- Capability inventory: The skill possesses the ability to execute shell commands and perform network fetches for verification purposes.
- Sanitization: There are no specific instructions for sanitizing or escaping the data fetched from external sources.
- [CREDENTIALS_UNSAFE]: The skill includes instructions to proactively detect and remove sensitive local information, such as '@personal' tags and local environment aliases, before publishing documentation. This practice mitigates the risk of accidental credential exposure.
Audit Metadata