feature-usage-feed
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-generated content from LLM traces through an LLM-judge evaluation system, which is a common attack surface for indirect prompt injection.
- Ingestion points: The skill uses
posthog:query-llm-traceandposthog:query-llm-traces-listinSKILL.mdto retrieve trace data that originates from external user interactions with PostHog features. - Boundary markers: The provided prompt template for the LLM judge does not define clear delimiters or "ignore instructions" warnings to separate the judge's instructions from the untrusted trace data being analyzed.
- Capability inventory: The skill leverages powerful evaluation tools including
posthog:llma-evaluation-createandposthog:llma-evaluation-runto process this data and output reasoning text that is then streamed to Slack. - Sanitization: There is no evidence of filtering, escaping, or sanitization of the trace content before it is interpolated into the prompt for the evaluation model.
Audit Metadata