working-with-scouts
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes scouts that ingest data from untrusted external sources and project logs, which creates a surface for indirect prompt injection where malicious instructions are hidden in processed content.
- Ingestion points: Scouts ingest content from external URLs such as status pages, changelogs, and research platforms like arXiv, as well as internal project database tables and event logs.
- Boundary markers: The documentation suggests using natural language instructions for the AI to treat fetched content as data rather than commands, but no technical isolation or strict boundary enforcement is described.
- Capability inventory: The system provides powerful data tools to the agents, including
posthog:execute-sql,posthog:read-data-schema, andposthog:scout-run-now. - Sanitization: No programmatic sanitization or filtering of the external data is specified within the skill body or references.
- [EXTERNAL_DOWNLOADS]: The skill provides guidance on configuring
network_access: "full"for scouts. This setting allows the agent to perform network requests to any external domain, which creates a high-risk path for data exfiltration if the agent's logic is subverted by malicious input from its ingestion points.
Audit Metadata