docs: production security hardening — threat model, prompt injection defense, and credential hygiene #1567

Problem

features/skill-security-scanner.md and reference/plugin-security.md cover tool-scoping and plugin sandboxing. Issue #1427 tracks a corporate security.md. Neither covers the production threat model that teams face when running Squad at scale: infectious prompt injection through shared state files, credential exposure from AI-generated code, supply chain risks in Actions workflows, least-privilege token provisioning per agent, and trust tiers for external content ingestion.

Specifically, Squad's shared .squad/decisions.md and .squad/history/ files create a prompt-injection vector unique to multi-agent architectures that is not flagged anywhere in the current docs.

Parent issue: #1564

Scope

New page: docs/src/content/docs/features/security-hardening.md

Threat model for production Squad deployments

• Credential exposure: AI-generated code with embedded secrets; .env anti-patterns
• Command injection via tool-use in agents with shell permissions
• Capability creep: agents accumulating permissions beyond their charter
• Supply chain attacks in generated or installed workflows
• Single-agent prompt injection (standard; cross-link to existing plugin-security.md)
• Infectious prompt injection (Squad-specific multi-agent vector)

Infectious prompt injection — Squad-specific callout

.squad/decisions.md and .squad/history/ are readable by all agents in a team. A malicious GitHub issue body summarized into shared memory can propagate adversarial instructions to all future agent sessions in the same team.

Note: This is a risk to document and test, not an established incident history. Docs should describe the attack surface and recommended mitigation — not claim it has been exploited in the wild.

Mitigation pattern — content quarantine at ingestion: Wrap external inputs (issue bodies, PR descriptions, external API responses) in explicit boundary markers before any agent processes them. Example: structured prompt prefix that delimits untrusted content and instructs the agent to treat it as data, not instruction.

Trust tier pattern

Categorize inputs:

• Trusted: repository state, committed .squad/ files, first-party API responses
• Semi-trusted: GitHub issue/PR content (user-submitted)
• Untrusted: external API responses, webhook payloads, scraped content

Least-privilege GitHub token matrix

Minimum required scopes per agent type (table format: agent type → required scopes → rationale).

Supply chain pinning

SHA-pinned Actions tags in generated workflows. Cross-link to #1462 (CI templates). Document the risk of mutable tags (@main, @latest) in generated workflows.

Credential hygiene

AI-generated code credential risk; .env anti-patterns (cross-reference to closed #267). Managed identity as the preferred alternative.

Acceptance Criteria

• Infectious prompt injection risk explicitly called out with Squad-specific scenario (shared .squad/decisions.md/history)
• Content quarantine pattern documented with a concrete example (boundary markers in prompt)
• Attack surface described as a risk to document and test — not claimed as an established incident
• Least-privilege token matrix covers: repo, read:org, project, workflow scopes with required/optional per agent type
• Supply chain pinning section cross-links to ci: pin actions in squad-insider-release.yml template to commit SHAs #1462
• .env anti-pattern cross-links to closed Agent can read and leak .env credentials into .squad/ committed files #267
• Clear relationship with Enhancement: Create a /docs/security.md for corporate security #1427: this page = operational threat model; Enhancement: Create a /docs/security.md for corporate security #1427 = corporate policy
• Cross-links to features/skill-security-scanner.md and reference/plugin-security.md

Non-Goals

• Replacing or duplicating the corporate policy page tracked in Enhancement: Create a /docs/security.md for corporate security #1427
• Covering Azure infrastructure security (IAM, NSGs, Key Vault policy) beyond credential injection patterns
• Formal CVE or vulnerability disclosure

Source / Inspiration

Tamir Dresher published a post on production security for Squad deployments. This is an inspiration and citation source — conclusions presented as novel threat-model observations should be framed as risks to document/test, not as established incidents.

Relation to Existing Issues

• Enhancement: Create a /docs/security.md for corporate security #1427 — Complementary, not duplicate. Enhancement: Create a /docs/security.md for corporate security #1427 = corporate policy/compliance page; this issue = operational threat model. Recommend siblings under a /security/ nav section. Draft from Enhancement: Create a /docs/security.md for corporate security #945 should be reviewed for overlap.
• docs milestone: real-world Squad hosting, integrations, and operations #1564 — Parent umbrella.

Priority

P1 — Security gap with a unique multi-agent attack surface not documented anywhere in the project.