posthog-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes shell execution markers to display the current Node.js version and PostHog SDK installation status directly in the skill's interface. These commands are benign and used solely for environmental awareness.
- [DATA_EXFILTRATION]: The diagnostic script performs network requests to official PostHog domains (
us.i.posthog.com,eu.i.posthog.com, andapp.posthog.com) to verify API health and event capture flow. These operations use environment variables provided by the user and are necessary for the skill's primary purpose. - [COMMAND_EXECUTION]: The skill provides a comprehensive bash script for the user to run, which aggregates system metadata (OS type, runtime versions), SDK package information, and connectivity results into a compressed archive for support troubleshooting.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes robust redaction logic to ensure that sensitive information is not exposed in the debug bundle. It uses
sedto mask values of PostHog-related environment variables and truncates API keys to only show the first four characters for identification purposes.
Audit Metadata