The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ! dynamic context injection in the SKILL.md file to execute node --version and npm list at skill load time. This behavior can lead to unexpected command execution when the skill is first opened by the agent.
[DATA_EXFILTRATION]: The diagnostic scripts use env | grep -i posthog to collect environment variables. Although it attempts to redact values using sed, this approach is prone to errors if the grep pattern is too broad or if sensitive data exists in non-matching variables.
[DATA_EXFILTRATION]: The skill accesses the POSTHOG_PERSONAL_API_KEY and uses it to perform authenticated network requests via curl to app.posthog.com/api/projects/. This data (project IDs and names) is written to a local file (projects.json) for inclusion in a diagnostic bundle.
[COMMAND_EXECUTION]: The skill contains multiple shell script blocks that perform system enumeration, including checking versions of node, npm, python3, and gathering OS information via uname.
[DATA_EXFILTRATION]: Step 2 and Step 3 involve sending local project information (project keys and distinct IDs) to external PostHog ingestion endpoints (us.i.posthog.com) via curl for 'capture' and 'decide' tests.

posthog-debug-bundle