signals-scout-web-analytics
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data originating from external web traffic.
- Ingestion points: The skill reads attacker-controlled data from the
sessionsandeventstables via theexecute-sqltool, specifically targeting fields like$entry_pathname,$entry_referring_domain,$entry_utm_source, and$entry_current_url. - Boundary markers: The skill contains a dedicated 'Untrusted data' section that explicitly warns the agent that acquisition data is 'attacker-adjacent' and must be treated strictly as data, not instructions.
- Capability inventory: The agent has the capability to execute SQL queries, write to internal memory via
signals-scout-scratchpad-remember, and emit signals viasignals-scout-emit-signal. - Sanitization: The instructions mandate the use of sanitized identifiers (truncation, slugification) and the use of short, quoted snippets when reporting user-supplied strings to mitigate the risk of the agent obeying embedded commands.
Audit Metadata