suede-recommend-next-action
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes untrusted data from external sources to generate its recommendations.
- Ingestion points: Reads current repository state, plan files, terminal history, and handoff documents (
SKILL.md). - Boundary markers: Uses instructions to keep the scoring logic internal, but lacks explicit delimiters for untrusted file content when generating the 'Quick prompt'.
- Capability inventory: Includes read-only file access and limited network checks (HTTP status codes) via subprocess calls.
- Sanitization: The skill does not explicitly describe sanitizing or escaping the data read from files before including it in the output prompt.
- [COMMAND_EXECUTION]: The skill instructions specify the use of shell commands to inspect system state.
- Evidence: Uses
git -C <target-repo> status --short --branchandgit -C <target-repo> log --oneline -5to verify repository history. - Evidence: Uses
curl -sS -o /dev/null -w '%{http_code}' <url>to check the status of live deployments. This specific configuration is read-only and does not exfiltrate data body content.
Audit Metadata