finding-sessions-to-watch
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the
posthog:execute-sqltool to run queries against the event database to retrieve session IDs. This is a standard and necessary function for identifying recordings where specific events occurred. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data such as event names and property values that could be influenced by project configuration. It includes a mandatory verification step requiring the agent to use
read-data-schemato confirm identifiers before using them in queries, which serves as a security control against processing untrusted or unexpected identifiers. - [INDIRECT_PROMPT_INJECTION]: The analysis identified an attack surface for indirect prompt injection. Ingestion points: Data enters the context via
read-data-schemaandexecute-sql. Boundary markers: The instructions do not define specific text delimiters but emphasize mapping intent to structured templates. Capability inventory: The skill has the ability to execute database queries and create filter views. Sanitization: The skill mandates validating all dynamic inputs against the existing data schema before execution.
Audit Metadata