signals-scout-health-checks
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is authored by the official vendor (PostHog) and performs legitimate administrative tasks using the vendor's own MCP toolset and analytics APIs.
- [SAFE]: It contains a dedicated security section ('Untrusted data — payload fields') that proactively mitigates Indirect Prompt Injection risks. It instructs the agent to treat project-supplied data as non-executable strings, use stable identifiers for keys, and quote external content to prevent it from being interpreted as instructions.
- [SAFE]: The use of analytics tools like
execute-sqlis scoped to predefined diagnostic queries (e.g., checking traffic volume or SDK versions) and does not involve executing user-supplied code or accessing sensitive credentials.
Audit Metadata