signals-scout-replay-vision

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data derived from end-user sessions (URLs, clicks, console text) and LLM-generated scanner outputs, which could contain adversarial instructions intended to influence the agent's behavior.
  • Ingestion points: The skill ingests untrusted data through execute-sql queries on the $recording_observed event table and various MCP tools like vision-scanners-observations-list. Specifically, it processes the scanner_output_tags, scanner_output_title, scanner_output_summary, and scanner_output_reasoning fields.
  • Boundary markers: The skill includes a dedicated section titled "Untrusted data — scanner output is LLM text over user content" which provides explicit instructions to the agent to treat this data strictly as content to be reported and never as instructions to be followed.
  • Capability inventory: The agent possesses the ability to author and edit reports (emit_report, edit_report) and maintain persistent state in a scratchpad (scout-scratchpad-remember).
  • Sanitization: The skill instructs the agent to sanitize identifiers by slugifying them and to truncate raw text snippets to minimize the risk of embedded instructions affecting the agent's decision-making logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 03:59 PM
Security Audit — agent-trust-hub — signals-scout-replay-vision