posthog-growth-workspace
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data retrieved from the PostHog API, which includes user-generated event properties and session metadata. This creates a theoretical surface for indirect prompt injection if the ingested data contains malicious instructions.\n
- Ingestion points: Data enters the environment via the PostHog API using the
scripts/pg-query.mjsscript, specifically when reading event logs, insights, and session recordings as described inreferences/platform-ops.mdandreferences/organic-search-outcomes.md.\n - Boundary markers: The skill contains explicit instructions in
references/organic-search-outcomes.mdto avoid persisting raw path values directly and to validate URLs against a canonical list before inclusion in reports.\n - Capability inventory: The skill has the capability to write to the local filesystem (
.growth/directory) and perform network requests to the PostHog API host viascripts/pg-query.mjs.\n - Sanitization: The instructions mandate path normalization, re-aggregation by canonical landing-page URLs, and the withholding of non-public or high-entropy paths (such as tokens or internal IDs) from aggregate exports.\n- [SAFE]: The skill follows security best practices for handling sensitive information and external services.\n
- The instructions explicitly forbid printing API keys and direct the user to store the
POSTHOG_PERSONAL_API_KEYin the environment to prevent credential exposure.\n - Network operations are limited to the well-known PostHog service for its intended purpose of product data retrieval, following the specific project-scoped access patterns defined in the HogQL cookbook.
Audit Metadata