The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted data from $mcp_tool_call events recorded in previous agent sessions.
Ingestion points: Data enters the agent context via HogQL queries against the events table, specifically pulling $mcp_intent and tool call properties in SKILL.md.
Boundary markers: The skill does not define boundary markers or explicit instructions to the agent to disregard instructions embedded in the session data.
Capability inventory: The skill uses posthog:execute-sql for reading events and posthog:mcp-analytics-sessions-generate-intent for LLM-based summarization.
Sanitization: There is no evidence of sanitization, validation, or filtering of the external session data before it is processed by the agent or the summarization tool.

exploring-mcp-sessions