exploring-ai-failures
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and interpret AI traces which can contain untrusted external data, creating an indirect prompt injection surface. \n
- Ingestion points: The tool
posthog:query-llm-traceretrieves raw data from$ai_inputand$ai_output_choices(File: SKILL.md). \n - Boundary markers: The instructions lack guidance on using delimiters or markers to distinguish between the agent's logic and the data being analyzed. \n
- Capability inventory: The agent has access to powerful capabilities including
posthog:execute-sqland platform URL generation. \n - Sanitization: No validation or filtering is specified for the trace content before it is processed by the agent. \n- [PROMPT_INJECTION]: Instructions in the 'Work with the user' section explicitly tell the agent to act autonomously ("don't stop to ask permission before the reading"). This proactive behavior reduces human oversight when the agent is handling potentially malicious log content. \n- [COMMAND_EXECUTION]: The skill uses
posthog:execute-sqlto discover trace taxonomies and count failure modes. This provides the agent with direct execution capabilities against the project database.
Audit Metadata