signals-scout-experiments
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from multiple external sources, which creates a surface for indirect prompt injection attacks where malicious content could influence the agent's behavior.
- Ingestion points: Data is ingested via
experiment-results-get(analytics data),execute-sql(database records), andinbox-reports-list(human-authored report content). - Boundary markers: The instructions lack specific requirements for the agent to use delimiters or to ignore embedded commands within these data streams.
- Capability inventory: The agent can write to external communication channels via
scout-emit-reportandscout-edit-report, and persist state viascout-scratchpad-remember, providing a potential path for data exfiltration or state manipulation. - Sanitization: No sanitization logic is defined for external data before it is interpolated into subsequent reports or queries.
- [DYNAMIC_EXECUTION]: The skill uses string templates to dynamically generate HogQL queries for the
execute-sqltool at runtime. Although these follow established templates for analytical purposes, the dynamic assembly of executable code from variable inputs at runtime is a recognized execution pattern.
Audit Metadata