checking-member-access
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions are purely diagnostic and educational, focusing on how to interpret output from existing PostHog access control tools. The skill explicitly states it is 'not for changing rules' and that 'read tools cannot write', adhering to the principle of least privilege.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external tool outputs (e.g.,
members-list). While this presents a theoretical surface for indirect prompt injection if the ingested data contains malicious instructions, the skill defines a rigid workflow for interpretation rather than execution. No file-write or arbitrary command execution capabilities are exposed through this skill (Severity: SAFE). - [EXTERNAL_DOWNLOADS]: The skill references an official vendor domain (
posthog.com) for plan comparisons. This is a trusted resource and does not involve code execution or unexpected network operations.
Audit Metadata