resolving-ingestion-warnings
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted, event-supplied data from the
system.ingestion_warningstable, creating an attack surface for indirect prompt injection. - Ingestion points: The skill reads the
detailsfield fromsystem.ingestion_warningsvia theposthog:execute-sqltool. This field contains raw JSON data provided by external event senders. - Boundary markers: The skill includes a dedicated "trust boundary" section in
SKILL.mdthat explicitly instructs the agent that warning details are untrusted input and must not be followed as instructions. - Capability inventory: The agent has access to sensitive tools including
posthog:execute-sql(database queries),posthog:project-settings-update(modifying project configuration), andposthog:persons-property-delete(deleting user data). - Sanitization: The instructions provide clear behavioral guidance to the agent to never let values found in warnings decide whether to run a query, edit code, or take any other action.
Audit Metadata