The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from the PostHog event stream and account tables, which could theoretically contain malicious instructions embedded by an attacker.
Ingestion points: The skill queries system.accounts (retrieving names and external IDs) and the events table (retrieving group keys and distinct user IDs) via the execute-sql tool, bringing this data into the agent's active context.
Boundary markers: The instructions do not specify the use of delimiters (like XML tags or triple quotes) to isolate external data from the agent's primary instructions, nor do they include explicit warnings to ignore instructions found within the processed data.
Capability inventory: The agent has the ability to execute read-only SQL queries, store data in a persistent scratchpad (scout-scratchpad-remember), and author/edit reports delivered to a report channel (emit_report, edit_report).
Sanitization: There is no mention of sanitizing or validating account names or event properties before they are processed or included in reports.
[DATA_EXFILTRATION]: The skill accesses commercial identifiers including Stripe, HubSpot, and Salesforce IDs to link account health to commercial value.
Evidence: The instructions guide the agent to query system.accounts for fields like stripe_customer_id, hubspot_deal_id, and sfdc_id.
Assessment: This behavior is consistent with the primary purpose of a customer analytics tool authored by PostHog and uses official vendor tools to report findings to internal channels.

signals-scout-customer-analytics