posthog
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlandjqfor legitimate API interaction and JSON processing. These are standard tools for interacting with REST APIs via the command line. - [CREDENTIALS_UNSAFE]: The skill provides instructions for the agent to check for the presence of
POSTHOG_API_KEYorPOSTHOG_PERSONAL_API_KEY. It explicitly warns against echoing the variable directly and provides a safe setup path using a vendor-specific tool (teleport-setup). It correctly distinguishes between public project tokens (phc_*) and sensitive personal keys (phx_*). - [EXTERNAL_DOWNLOADS]: All network operations are directed towards official PostHog infrastructure (us.posthog.com, eu.posthog.com). There are no downloads or executions from unknown or untrusted third-party sources.
- [PROMPT_INJECTION]: The skill contains instructional text intended to guide the agent's behavior during credential setup, but these are standard operational constraints rather than malicious attempts to override safety filters.
Audit Metadata