debugging-surveys

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/repos.py uses the subprocess module to execute git clone when a required repository is not found locally. The execution is restricted to the official PostHog GitHub organization.
  • [EXTERNAL_DOWNLOADS]: The skill downloads source code from the author's official GitHub repositories (github.com/PostHog/*) to facilitate cross-SDK development and debugging.
  • [DATA_EXFILTRATION]: The scripts/repos.py utility scans local directory structures (including ~/src, ~/code, ~/dev, and others) to identify existing PostHog git checkouts by reading their .git/config files. Discovered paths are recorded in a local JSON file at ~/.config/posthog-surveys/repos.json.
  • [PROMPT_INJECTION]: The skill processes support tickets as input, which constitutes an indirect prompt injection surface. The risk is minimized as the workflow primarily involves read-only diagnostic queries and local code inspection.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 03:05 PM
Security Audit — agent-trust-hub — debugging-surveys