suede-sync-packaging
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, specifically song lyrics, existing pitches, and music supervisor feedback.
- Ingestion points: Lyrics and pitch history are ingested during the 'Input contract' phase.
- Boundary markers: The skill does not define specific delimiters or instructions for the agent to treat these inputs as data only.
- Capability inventory: The skill is limited to generating text-based responses (one-sheets, pitch emails) and does not have file-system write, network, or code execution capabilities.
- Sanitization: No explicit sanitization of lyric content is mentioned beyond screening for profanity and themes.
- [SAFE]: The skill implements strong integrity gates, explicitly instructing the agent to never claim rights clearance or resolve legal questions autonomously. It uses a vendor-specific routing system to redirect complex tasks to appropriate specialized skills.
Audit Metadata