planning-voice-agent-user-interviews
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface in Step 5 and Step 2.
- Ingestion points: Untrusted data enters the agent context through SQL query results of person properties (Step 2) and user-pasted CSV data for per-interviewee context (Step 5).
- Boundary markers: The instructions do not define boundary markers or delimiters for the agent_context string passed to the voice agent, which could allow instructions embedded in properties or CSVs to be treated as high-priority commands.
- Capability inventory: The agent uses execute-sql to fetch user data and user-interview-topics-create to store the context for the automated caller.
- Sanitization: While the skill enforces schema validation for event names and CSV parsing rules, it does not specify sanitization or escaping for the natural language context strings passed to the LLM-driven voice agent.
- [COMMAND_EXECUTION]: The skill uses execute-sql to perform behavioral analysis on user events using HogQL templates. It mitigates injection risks by requiring the agent to validate event names against the project's data schema (read-data-schema) before query execution.
- [DATA_EXFILTRATION]: The skill identifies and processes sensitive user information, including email addresses and unique identifiers. This data is handled exclusively through internal PostHog API tools (user-interview-topics-create) for the intended product purpose and is not transmitted to unauthorized external domains.
Audit Metadata