posthog-analytics

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection by ingesting untrusted data from an external API (PostHog) and incorporating it into the agent's context.
  • Ingestion points: The skill retrieves data from PostHog using tools such as event-definitions-list, properties-list, insights-get-all, list-errors, and error-details (found in SKILL.md).
  • Boundary markers: There are no explicit instructions or delimiters used to warn the agent about ignoring potential instructions embedded within the retrieved event names, property descriptions, or error messages.
  • Capability inventory: The skill has the capability to perform follow-up actions based on this data, including running complex queries (query-run), creating dashboards (dashboard-create), and setting up experiments (experiment-create). It also writes to a local context file (.claude/product-context.md).
  • Sanitization: No sanitization or validation logic is present to filter out executable-like instructions from the external metadata before it is processed by the AI.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 01:25 PM
Security Audit — agent-trust-hub — posthog-analytics