working-with-scouts

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill describes scouts that ingest data from untrusted external sources and project logs, which creates a surface for indirect prompt injection where malicious instructions are hidden in processed content.
  • Ingestion points: Scouts ingest content from external URLs such as status pages, changelogs, and research platforms like arXiv, as well as internal project database tables and event logs.
  • Boundary markers: The documentation suggests using natural language instructions for the AI to treat fetched content as data rather than commands, but no technical isolation or strict boundary enforcement is described.
  • Capability inventory: The system provides powerful data tools to the agents, including posthog:execute-sql, posthog:read-data-schema, and posthog:scout-run-now.
  • Sanitization: No programmatic sanitization or filtering of the external data is specified within the skill body or references.
  • [EXTERNAL_DOWNLOADS]: The skill provides guidance on configuring network_access: "full" for scouts. This setting allows the agent to perform network requests to any external domain, which creates a high-risk path for data exfiltration if the agent's logic is subverted by malicious input from its ingestion points.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 09:40 AM
Security Audit — agent-trust-hub — working-with-scouts