suede-ship
Warn
Audited by Snyk on Aug 22, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). In
workflows/suede-ship.js, outsider-providedargs.scopeis injected into multiple LLM phases (e.g., Scout/Research/Plan) before the workflow determines specific files, meaning free text from a user can influence the agent workflow broadly; however, it is not described as ingesting third-party submitted content from external systems like email/feeds/issue bodies.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata