investigating-replay
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session recordings, person profiles, and event properties (such as exception messages and URLs) that are retrieved using tools like
posthog:execute-sql. This content could contain malicious instructions designed to influence the agent's final summary. - Ingestion points: Data is pulled from the PostHog platform into the agent context via
posthog:session-recording-get,posthog:persons-retrieve, andposthog:execute-sql. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided in the instructions to protect the synthesis step.
- Capability inventory: The agent has the ability to execute SQL queries and manage vision scanners within the PostHog environment.
- Sanitization: There are no instructions for sanitizing or validating the retrieved event data before the agent processes and summarizes it.
Audit Metadata