signals-scout-observability-gaps
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted event names and metadata through its analytical tools. Ingestion points: Event names from the read-data-schema tool and top_events from the project profile metadata. Boundary markers: Explicit instructions to treat these names as data rather than SQL instructions. Capability inventory: Access to the execute-sql tool and internal reporting tools (emit_report). Sanitization: Mandatory manual escaping of quotes, backslashes, and SQL wildcards to mitigate injection risks.
- [COMMAND_EXECUTION]: The skill performs read-only SQL queries on system and event tables via execute-sql. The potential for SQL injection is addressed by specific prompt instructions requiring the agent to escape all user-derived event names before interpolation.
- [DATA_EXFILTRATION]: Research findings are strictly contained within the PostHog platform, using internal scratchpad and report-channel tools. The skill does not perform any external network requests or sensitive file access that could lead to data exfiltration.
Audit Metadata