auditing-warehouse-view-health
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing external data from the PostHog data warehouse.
- Ingestion points: External data is ingested through the
data-warehouse-data-health-issues-retrieve,view-list, andwarehouse-suggestions-listtools, which return metadata such as view names, error messages, and usage suggestions inSKILL.md. - Boundary markers: The instructions do not define explicit delimiters (e.g., XML tags or triple backticks with headers) to separate untrusted data from the system prompt.
- Capability inventory: The skill has access to tools capable of modifying the environment, such as
view-unmaterializeandview-delete(mentioned in workflow steps), and suggests fixing HogQL code. - Sanitization: No sanitization or validation of the retrieved metadata is specified before it is presented or acted upon.
- Mitigation: The instructions explicitly require the agent to obtain human confirmation before performing any destructive or state-changing operations, which serves as a critical defense against autonomous obedience to injected instructions.
Audit Metadata