signals-scout-replay-vision
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data derived from end-user sessions (URLs, clicks, console text) and LLM-generated scanner outputs, which could contain adversarial instructions intended to influence the agent's behavior.
- Ingestion points: The skill ingests untrusted data through
execute-sqlqueries on the$recording_observedevent table and various MCP tools likevision-scanners-observations-list. Specifically, it processes thescanner_output_tags,scanner_output_title,scanner_output_summary, andscanner_output_reasoningfields. - Boundary markers: The skill includes a dedicated section titled "Untrusted data — scanner output is LLM text over user content" which provides explicit instructions to the agent to treat this data strictly as content to be reported and never as instructions to be followed.
- Capability inventory: The agent possesses the ability to author and edit reports (
emit_report,edit_report) and maintain persistent state in a scratchpad (scout-scratchpad-remember). - Sanitization: The skill instructs the agent to sanitize identifiers by slugifying them and to truncate raw text snippets to minimize the risk of embedded instructions affecting the agent's decision-making logic.
Audit Metadata