The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including event names, event definitions, and insight metadata (names and descriptions). This data is interpolated into SQL queries and used to generate human-readable reports. An attacker could potentially embed instructions or malicious strings in event metadata to influence the agent's logic or social-engineer the report reviewer.
Ingestion points: Untrusted data enters the context via read-data-schema, event-definitions-list, and queries against system.insights (SKILL.md).
Boundary markers: None explicitly defined in the prompt interpolation logic.
Capability inventory: The skill can execute SQL queries (execute-sql), write to a scratchpad (scout-scratchpad-remember), and emit reports (scout-emit-report).
Sanitization: The skill includes logic for volume filtering and stability checks (7-day bar), but lacks explicit sanitization of strings before interpolation into SQL ILIKE patterns or report bodies.
[COMMAND_EXECUTION]: The skill utilizes execute-sql to perform analytical research on system.* tables. This is a primary intended function of the skill within the PostHog agent environment and is used to verify event coverage and volume.
[PERSISTENCE]: The skill implements a 'watch lifecycle' using the scout-scratchpad-remember tool to maintain state across multiple runs. This allows the agent to track potential observability gaps over time and ensures that recommendations are only filed once a stability threshold is met.

signals-scout-observability-gaps