posthog-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection by ingesting untrusted data from an external API (PostHog) and incorporating it into the agent's context.
- Ingestion points: The skill retrieves data from PostHog using tools such as
event-definitions-list,properties-list,insights-get-all,list-errors, anderror-details(found inSKILL.md). - Boundary markers: There are no explicit instructions or delimiters used to warn the agent about ignoring potential instructions embedded within the retrieved event names, property descriptions, or error messages.
- Capability inventory: The skill has the capability to perform follow-up actions based on this data, including running complex queries (
query-run), creating dashboards (dashboard-create), and setting up experiments (experiment-create). It also writes to a local context file (.claude/product-context.md). - Sanitization: No sanitization or validation logic is present to filter out executable-like instructions from the external metadata before it is processed by the AI.
Audit Metadata