signals-scout-session-replay
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data provided by end-user browsers, which is inherently untrusted. This includes URLs, element text, console messages, and AI-generated session summaries.
- Ingestion points: Data enters the agent context via
execute-sqlresults from theeventsandsession_replay_featurestables, as well as metadata fromsession-recording-summary-get. - Boundary markers: The instructions explicitly direct the agent to quote user-supplied strings as short snippets and truncate prose aggressively.
- Capability inventory: The skill has the ability to execute SQL queries, emit/edit reports via internal channels, and store state in a scratchpad.
- Sanitization: The skill mandates the use of slugified or truncated identifiers instead of raw user strings and includes a specific section on treating session content as data rather than instructions to prevent prompt injection.
- [COMMAND_EXECUTION]: The skill utilizes the
execute-sqltool to perform analytical queries on PostHog data. These queries are predefined within the skill's instructions to ensure accuracy and limit scope to read-only analytics.
Audit Metadata