debugging-surveys
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/repos.pyuses thesubprocessmodule to executegit clonewhen a required repository is not found locally. The execution is restricted to the official PostHog GitHub organization. - [EXTERNAL_DOWNLOADS]: The skill downloads source code from the author's official GitHub repositories (
github.com/PostHog/*) to facilitate cross-SDK development and debugging. - [DATA_EXFILTRATION]: The
scripts/repos.pyutility scans local directory structures (including~/src,~/code,~/dev, and others) to identify existing PostHog git checkouts by reading their.git/configfiles. Discovered paths are recorded in a local JSON file at~/.config/posthog-surveys/repos.json. - [PROMPT_INJECTION]: The skill processes support tickets as input, which constitutes an indirect prompt injection surface. The risk is minimized as the workflow primarily involves read-only diagnostic queries and local code inspection.
Audit Metadata