signals-scout-web-analytics
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a standard analytical tool that operates within the designated PostHog MCP environment. It uses SQL queries to process session and event data to detect traffic anomalies.
- [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill accesses project analytics data, it does so through official platform tools (
execute-sql) and reports findings via the project's internal inbox mechanism. There are no attempts to access sensitive system files or exfiltrate data to external domains. - [INDIRECT_PROMPT_INJECTION]: The skill specifically addresses the risk of processing untrusted data from browser-supplied fields like URLs, UTM tags, and referrers. It provides clear defensive instructions to the agent, such as truncating snippets, using sanitized identifiers, and never treating data values as instructions or authorization for actions.
- [COMMAND_EXECUTION]: The skill uses SQL for data analysis but does not generate or execute shell commands or arbitrary code. All database interactions are scoped to analytics tables (
sessions,events).
Audit Metadata