The Agent Skills Directory

[SAFE]: The skill does not contain any malicious patterns. It follows best practices for using PostHog's internal tools to analyze AI traces. All network activity is restricted to generating deep links to the PostHog application, and no evidence of data exfiltration, unauthorized command execution, or obfuscation was found. The skill's instructions encourage human review of generated links and use standard vendor resources.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for processing untrusted data found in production AI traces. While inherent to the skill's purpose, this surface could be used to present malicious instructions to the agent during analysis. 1. Ingestion points: The posthog:query-llm-trace tool fetches $ai_input and $ai_output content from the posthog.ai_events table into the agent's context. 2. Boundary markers: The instructions do not specify explicit delimiters or 'ignore' warnings for the trace content being read. 3. Capability inventory: Available tools include SQL execution (posthog:execute-sql), trace listing, and URL generation. 4. Sanitization: No automated sanitization of trace content is mentioned; the skill relies on the agent's ability to categorize the content for human review.

exploring-ai-failures