user-deep-dive
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to input manipulation because it performs unsafe interpolation of user-provided arguments into SQL queries and URLs.
- Ingestion points: The $ARGUMENTS (email) and the response to the time window prompt (days) are used as variables in SKILL.md.
- Boundary markers: No delimiters or safety instructions are provided to prevent the agent from executing malicious payloads embedded in the user inputs.
- Capability inventory: The skill uses the query-run tool to execute SQL, providing a powerful vector for data exposure if the query logic is subverted.
- Sanitization: No validation or escaping is applied to the {email} or {days} placeholders before they are inserted into SQL strings like WHERE person.properties.email = '{email}' or interval {days} day.
- [DATA_EXFILTRATION]: The skill aggregates PII and granular behavioral metadata from PostHog and Vitally.
- Evidence: It retrieves top events, visited URLs, specific insights viewed, and session replay history.
- Context: While this is the intended functionality for internal customer success teams, the aggregation of this level of detail (including recording view history and AI usage context) constitutes significant data exposure.
Audit Metadata