finding-sessions-to-watch
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests external metadata (event names and property values) to construct filters and SQL queries. This is an inherent property of the tool's intended data-querying functionality.
- Ingestion points: Data enters the context via the
posthog:read-data-schematool call described in SKILL.md. - Boundary markers: The skill does not explicitly use delimiters to wrap the output of the schema discovery tool.
- Capability inventory: The skill utilizes
posthog:execute-sqlandposthog:query-session-recordings-listto perform operations based on discovered data. - Sanitization: The instructions guide the agent to verify that events exist in the schema before use, though it does not mandate specific character escaping for the values.
- [COMMAND_EXECUTION]: The skill uses
posthog:execute-sqlto perform dynamic data retrieval. It provides structured SQL templates for the agent to use, focusing on legitimate analytical tasks such as filtering by session IDs or rage-click events.
Audit Metadata