The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill takes a free-text prompt argument from the user which is processed by an LLM to generate HogQL queries and Markdown reports. This creates a vulnerability surface where a malicious prompt could attempt to manipulate the generated queries or the final report content delivered to external communications channels.
Ingestion points: The prompt field in the posthog:subscriptions-create tool serves as the primary entry point for untrusted natural language data.
Boundary markers: The skill documentation does not provide instructions for using boundary markers, delimiters, or system-level constraints to prevent the LLM from obeying instructions embedded within the user prompt.
Capability inventory: The skill facilitates a high-privilege chain where project data is read (via query:read scope and HogQL) and subsequently exfiltrated to external targets (email addresses or Slack channels via subscription:write scope).
Sanitization: There is no mention of sanitization, validation, or schema enforcement for the prompt input before it is interpolated into the LLM synthesis pipeline.

creating-ai-subscription