analyzing-expensive-users
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze LLM traces and metadata that contain untrusted external data (user prompts and model outputs). This content could contain malicious instructions designed to manipulate the agent's behavior during the analysis process.
- Ingestion points: Untrusted data enters the agent context via
posthog:execute-sql(which reads event properties) andposthog:query-llm-trace(which reads the full contents of LLM interactions). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing the content of traces or custom properties.
- Capability inventory: The agent has access to
posthog:execute-sqlfor database queries andposthog:generate-app-urlfor generating navigation links. It also has access to several other PostHog-specific tools for schema discovery and trace listing. - Sanitization: There are no explicit instructions for sanitizing or escaping the content retrieved from event properties or trace logs before the agent interprets it.
Audit Metadata