signals-scout-skills-store
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from a skill store, including skill bodies, descriptions, and bundled files. This creates an attack surface where a malicious skill could attempt to influence the scout's reporting behavior or actions through instructions embedded in the analyzed data.
- Ingestion points: The skill reads external data using
skill-get(for skill bodies and metadata) andskill-file-get(for bundled files). - Boundary markers: The instructions explicitly direct the agent to treat all ingested content as data rather than instructions, though it lacks formal technical delimiters for tool outputs.
- Capability inventory: The agent possesses capabilities to emit or edit reports (
scout-emit-report,scout-edit-report), execute SQL queries (execute-sql), and store state in a scratchpad. - Sanitization: The skill contains robust instructions to sanitize quoted snippets, redact any discovered credential values, and strictly treat fetched pages as data.
- [EXTERNAL_DOWNLOADS]: The skill attempts to refresh its audit checklist from external sources including Anthropic's official documentation, Anthropic's public GitHub repository, and the agentskills.io domain. These are recognized as trusted organizations or well-known services. The skill is instructed to treat the fetched content as data for updating its internal checklist rather than as executable code.
Audit Metadata