scout

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from bug reports, logs, and screen recordings (videos/images) to drive its investigation and multi-engine analysis. This creates a surface where malicious instructions embedded in the analyzed data could potentially influence the agent's behavior.
  • Ingestion Points: Processes bug reports, logs, traces, and video files (MP4/MOV/WebM) as defined in SKILL.md and reference/video-bug-analysis.md.
  • Boundary Markers: Utilizes structured output schemas (e.g., video-bug-detection.schema.json) to constrain the output of analysis subagents.
  • Capability Inventory: The skill calls subagents (Codex, Antigravity, Claude) and diagnostic CLI tools based on the content of the investigation.
  • Sanitization: Employs PII masking and redaction during the video preprocessing stage as described in reference/video-bug-analysis.md to mitigate data exposure risks.
  • [COMMAND_EXECUTION]: The skill orchestrates the execution of numerous system-level diagnostic utilities and profilers to identify root causes of software failures.
  • Evidence: The skill provides workflows for running tools such as py-spy, clinic flame, go tool pprof, async-profiler, memray, and jmap as seen in the perf and memory recipes.
  • Evidence: The video recipe involves executing the codex exec CLI tool to perform visual analysis on extracted video frames, as detailed in reference/video-bug-analysis.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 12:45 PM