suede-rights-audit
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted data from creator projects (including songs, stems, metadata, artwork, and lyrics) to identify rights gaps.
- Ingestion points: Processes external project files, metadata files, and public URLs provided during the audit lanes (SKILL.md, references/lanes.md).
- Boundary markers: The skill mandates the use of a structured evidence table to separate confirmed facts from inferences, which serves as a logical workflow boundary but does not provide a technical safeguard against adversarial instructions embedded in the project files.
- Capability inventory: The skill instructions focus on data organization and do not explicitly invoke dangerous tools, although the skill operates within an environment (Claude Code/Codex) with file-reading and multi-agent orchestration capabilities.
- Sanitization: There are no instructions for sanitizing, escaping, or filtering the content ingested from the audited files before the agent processes it.
Audit Metadata