instrument-error-tracking

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to retrieve or ask the user for PostHog project API tokens and write those exact values into env files (or otherwise embed them), which requires the LLM to handle and output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The web/HTML snippet initializes posthog with api_host set to https://us.i.posthog.com which at runtime injects and loads a remote script (p.src → https://us-assets.i.posthog.com/static/array.js) that executes code in the client and is required for the HTML SDK to function.