exploring-llm-costs
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
posthog:execute-sqltool to run HogQL queries against the project's event database. This is the primary intended function of the skill to perform cost aggregations and trend analysis. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from event properties (such as
$ai_model,$ai_provider, and custom user-defined properties) when performing breakdowns and filters. - Ingestion points: Data enters the agent context via the
eventstable in PostHog, specifically from$ai_generationand$ai_embeddingevents in files likeSKILL.mdandreferences/breakdown-patterns.md. - Boundary markers: Not explicitly defined for property values, as they are processed as data fields within SQL aggregations.
- Capability inventory: The skill has the ability to execute SQL queries, create insights, dashboards, and alerts through the PostHog API.
- Sanitization: The skill encourages using the
posthog:read-data-schematool to discover valid property names rather than guessing, and uses a specialized tool (posthog:generate-app-url) for safe URL construction to avoid region/project mismatches.
Audit Metadata