signals-scout-unused-features
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong data privacy controls. It provides specific HogQL (PostHog SQL) query templates that use regex replacement to automatically mask potentially sensitive information such as email addresses, UUIDs, and system identifiers before data is processed or reported.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from two primary sources: product telemetry (event data) and cloned source code repositories. It effectively mitigates injection risks by explicitly instructing the agent to treat all imported code as data and never as instructions. Furthermore, it enforces strict normalization and boundaries on the telemetry data it reads.
- [COMMAND_EXECUTION]: The skill utilizes standard development and analysis tools (git, grep, and SQL) to perform its function. These operations are conducted within a sandboxed environment and are restricted to read-only analysis of the target project's assets.
- [DATA_EXFILTRATION]: Data reporting is handled through platform-integrated tools (emit_report), ensuring that analyzed data remains within the intended organizational boundaries. The instructions explicitly forbid the inclusion of raw customer content in these reports.
Audit Metadata