signals-scout-insight-alerts
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the ingestion of user-controlled metadata from the PostHog platform.
- Ingestion points: The skill retrieves potentially attacker-influenced data such as alert names, insight names, and threshold conditions using the
alerts-list,alert-get, andinsight-gettools (SKILL.md). - Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted data from the agent's core instructions when it triages firings or constructs reports.
- Capability inventory: The agent has the capability to write to persistent state via
scout-scratchpad-rememberand to externalized report channels viascout-emit-reportandscout-edit-report(SKILL.md). - Sanitization: The skill lacks evidence of sanitization, filtering, or validation of data retrieved from the API before it is processed by the LLM, allowing malicious alert names to potentially influence the scout's prioritization or reporting logic.
Audit Metadata