posthog

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to ask the user to paste a Personal API Key into the conversation and then embeds that token verbatim into command-line invocations (e.g., ruby ... save_token.rb 'PASTED_TOKEN'), so the LLM would receive and output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill makes runtime API calls to an external PostHog instance (BASE_URL defaults to https://app.posthog.com or a user-provided self-hosted URL) and directly reads user-generated content such as events, annotations, persons, insights, and feature-flag details (e.g., annotation['content'], event names, flag metadata) which the agent presents and can act upon (for example selecting and toggling feature flags), so untrusted third-party content can influence decisions and tool use.