The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Step 2 and Step 4) provide SQL query templates that use direct string interpolation for the $session_id parameter (e.g., WHERE $session_id = '<session_id>'). This pattern encourages the agent to build queries by concatenating user-provided input, which could allow a malicious user to perform SQL injection and execute unauthorized queries within the PostHog environment.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through manipulated diagnostic data.
Ingestion points: The agent ingests data from the events table via the posthog:execute-sql tool in SKILL.md.
Boundary markers: The skill lacks instructions or markers to distinguish between authentic SDK-emitted properties and potentially spoofed properties injected by a malicious user into the events stream.
Capability inventory: The skill uses database query tools (posthog:execute-sql) and recording retrieval tools (posthog:session-recording-get).
Sanitization: There is no mention of sanitizing or validating the properties retrieved from the database before they are used to determine the diagnostic verdict.
[SAFE]: The skill references troubleshooting documentation on posthog.com. As PostHog is the official author of the skill, these references to their own domain are considered safe and routine.

diagnosing-missing-recordings