planning-voice-agent-user-interviews
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute HogQL queries against the PostHog database via the
execute-sqltool. These queries are used to count cohort members and identify user segments based on behavioral events (e.g., heavy users, drop-offs). - [DATA_EXFILTRATION]: The workflow involves extracting PII (person email addresses and distinct IDs) from the database to populate the targeting parameters for the automated voice agent. This extraction is the primary intended function of the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources that is subsequently used to configure the voice agent's behavior, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: SQL query results (specifically person properties and event counts) and user-supplied CSV data (formatted as
identifier,context) in Step 5. - Boundary markers: The instructions do not specify any delimiters or safety markers to separate ingested data from the agent's internal instructions.
- Capability inventory: The skill uses
execute-sql,user-interview-topics-create, anduser-interview-topics-interviewees-bulk-createto process and transmit the ingested data. - Sanitization: While basic email validation is mentioned, the skill lacks sanitization or validation for the
agent_contextstrings provided via CSV or the person properties retrieved from the database before they are incorporated into the voice agent's context.
Audit Metadata