exploring-llm-traces
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes AI trace data which includes untrusted content from LLM prompts, completions, and tool results. A malicious trace could contain instructions designed to manipulate the agent's behavior or analysis during the debugging process.
- Ingestion Points: Trace data is fetched via
posthog:query-llm-trace,posthog:query-llm-traces-list, andposthog:execute-sqltools. - Boundary Markers: No explicit delimiters or instructions are provided to the agent to treat trace content as untrusted data.
- Capability Inventory: The agent can execute local scripts, perform complex SQL queries, and read local files.
- Sanitization: No sanitization logic is present for the handled trace content.
- [COMMAND_EXECUTION]: The skill provides and instructs the agent to execute several Python scripts (e.g.,
print_summary.py,extract_conversation.py) to process and summarize trace data. While these scripts are part of the skill and appear benign, they constitute an explicit command execution capability within the skill's operational instructions.
Audit Metadata