signals-scout-mcp-tool-calls
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze $mcp_tool_call telemetry events. Several fields within these events, such as $mcp_intent, $mcp_tool_name, and $mcp_error_message, are supplied by the client and are therefore untrusted data sources.
- Ingestion points: The agent reads these fields via execute-sql queries defined in references/queries.md.
- Boundary markers: The SKILL.md file contains a dedicated security section titled 'Untrusted data — tool names, categories, and messages' which explicitly warns the agent to treat this data as telemetry to be reported, not as instructions to be followed.
- Capability inventory: The agent has the ability to query data via execute-sql and publish findings via scout-emit-report and scout-record-output.
- Sanitization: The instructions mandate quoting telemetry as 'short untrusted snippets', truncating messages, and verifying findings against aggregate counts rather than individual rows.
Audit Metadata