scout
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from bug reports, logs, and screen recordings (videos/images) to drive its investigation and multi-engine analysis. This creates a surface where malicious instructions embedded in the analyzed data could potentially influence the agent's behavior.
- Ingestion Points: Processes bug reports, logs, traces, and video files (MP4/MOV/WebM) as defined in
SKILL.mdandreference/video-bug-analysis.md. - Boundary Markers: Utilizes structured output schemas (e.g.,
video-bug-detection.schema.json) to constrain the output of analysis subagents. - Capability Inventory: The skill calls subagents (Codex, Antigravity, Claude) and diagnostic CLI tools based on the content of the investigation.
- Sanitization: Employs PII masking and redaction during the video preprocessing stage as described in
reference/video-bug-analysis.mdto mitigate data exposure risks. - [COMMAND_EXECUTION]: The skill orchestrates the execution of numerous system-level diagnostic utilities and profilers to identify root causes of software failures.
- Evidence: The skill provides workflows for running tools such as
py-spy,clinic flame,go tool pprof,async-profiler,memray, andjmapas seen in theperfandmemoryrecipes. - Evidence: The
videorecipe involves executing thecodex execCLI tool to perform visual analysis on extracted video frames, as detailed inreference/video-bug-analysis.md.
Audit Metadata