signals-scout-web-analytics
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is to query analytics data and author reports within a sanctioned environment (Claude sandbox with PostHog MCP). It uses legitimate tools like
execute-sql,emit_report, andedit_reportto perform its tasks. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates high security awareness regarding untrusted data. It explicitly warns about 'Referrer spam' (malicious URLs/referrers) and provides instructions for mitigations, such as using sanitized identifiers and truncating untrusted snippets from the acquisition stream.
- [SAFE]: Data persistence is handled via a platform-provided scratchpad for storing baselines, deduplication keys, and reporting state. This is a standard and safe way to maintain context between runs.
- [SAFE]: All operations are scoped to analytics data (sessions and events tables) and do not involve access to sensitive system files, credentials, or unauthorized network endpoints.
Audit Metadata