The Agent Skills Directory

[SAFE]: The skill facilitates legitimate interactions with the PostHog API. The instructions focus on searching for existing dashboards, retrieving templates, and creating insights, all of which are standard operations for the intended analytics purpose. No sensitive data exfiltration or credential harvesting patterns were found.
[NO_CODE]: The skill contains no executable scripts (e.g., Python, JavaScript) or binary files. It relies exclusively on markdown-based instructions for tool usage within the platform's environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a standard attack surface for indirect prompt injection as it ingests external data from the PostHog platform.
Ingestion points: Dashboard names and descriptions are retrieved via dashboards-get-all and dashboard-get; existing insights are processed via insight-get.
Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore instructions that might be embedded within dashboard or insight metadata.
Capability inventory: The skill has the capability to modify the user's environment by creating or updating dashboards and insights using tools like insight-create and dashboard-update.
Sanitization: There is no mention of sanitization or filtering for retrieved content before the agent interprets it. This surface is considered a standard risk for integration skills and does not indicate malicious intent.

building-a-dashboard