signals-scout-ingestion-warnings
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill identifies a potential indirect prompt injection surface and includes a mandatory evidence chain for its mitigation: 1. Ingestion points: Untrusted data enters the agent context via 'ingestion-warnings-list' samples (details, distinct_id) and 'execute-sql' results. 2. Boundary markers: The skill includes a dedicated 'Untrusted data — details and identifiers' section explicitly instructing the agent to treat these values strictly as data and never as instructions. 3. Capability inventory: Tool access is limited to internal reporting (
emit_report,edit_report) and local data analysis tools. 4. Sanitization: Instructions require quoting untrusted values as short snippets and avoiding their use in scratchpad keys. - [DATA_EXFILTRATION]: The execution environment is restricted to a Claude sandbox with specific MCP scopes. The tools provided are focused on reporting within the PostHog platform, and there are no generic network access tools (such as curl or wget) that would allow for external data exfiltration.
- [COMMAND_EXECUTION]: The 'execute-sql' tool is used for corroborating data loss impact. The instructions provide clear guidance on using structured queries to count events and identify version mixes, rather than constructing arbitrary shell or system commands from unsanitized external strings.
Audit Metadata