working-with-scouts
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the management of AI agents ("scouts") that ingest data from potentially untrusted external sources and internal database queries, creating a surface for indirect prompt injection.
- Ingestion points: Scouts can be configured to fetch data from external URLs (such as status pages or changelogs) when granted full network access, and they ingest internal project data via database queries and user-provided feedback notes.
- Boundary markers: The skill specifically advises users to instruct scouts to treat fetched content as untrusted data rather than instructions to mitigate injection risks.
- Capability inventory: Scouts may hold significant write permissions within the PostHog platform, including
dashboard:write,insight:write,alert:write,warehouse_table:write, andllm_skill:write(which allows credential rotation). - Sanitization: The operating manual emphasizes that users should verify LLM-generated findings against live data or code before implementing fixes.
- [COMMAND_EXECUTION]: The skill instructions utilize the
posthog:execute-sqltool to ground agent tasks in real telemetry data. This is a standard platform capability used here for legitimate data analysis within the PostHog environment.
Audit Metadata